{"action":"Upgrade org.xwiki.platform:xwiki-platform-oldcore to 15.10.16 (15.10.x), 16.4.7 (16.4.x) or 16.10.2 (16.10.x) or later.","affected":[{"fixed":"15.10.16","introduced":"1.0"},{"fixed":"16.4.7","introduced":"16.0.0-rc-1"},{"fixed":"16.10.2","introduced":"16.5.0-rc-1"}],"component":"org.xwiki.platform:xwiki-platform-oldcore","cve_ids":["CVE-2024-56158"],"ecosystem":"Maven","epss":0.00534,"exploited":false,"fixed_versions":["15.10.16","16.4.7","16.10.2"],"ghsa_id":"GHSA-prwh-7838-xf82","id":"tcs_01M5N9805M9NG2S8E57YH524XK","modified_at":"2026-02-03T03:02:46.256732Z","published_at":"2025-06-12T21:52:50Z","references":["https://osv.dev/vulnerability/GHSA-prwh-7838-xf82","https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-prwh-7838-xf82","https://nvd.nist.gov/vuln/detail/CVE-2024-56158","https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d","https://github.com/xwiki/xwiki-platform","https://jira.xwiki.org/browse/XWIKI-22734"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-prwh-7838-xf82","url":"https://osv.dev/vulnerability/GHSA-prwh-7838-xf82"}],"summary":"XWiki allows SQL injection in query endpoint of REST API with Oracle"}