CVE-2025-24893

Exploited in the Wild ✓ Confirmed 0-Day

Triaged: March 5, 2026 3 articles

VulnLookup ↗ NVD ↗ MITRE ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

93.75%

probability

This CVE has a 93.75% probability of being exploited in the next 30 days.

0% Top 99.9th percentile of all CVEs 100%

CVSS score unavailable

Neither CIRCL nor NVD returned a CVSS score for this CVE. View on VulnerabilityLookup ↗

Attack Intelligence

CWE-664 · Improper Control of a Resource Through its Lifetime CWE-707 · Improper Neutralization CWE-74 · Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-913 · Improper Control of Dynamically-Managed Code Resources CWE-94 · Code Injection CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Exploits & PoC

gunzf0x/CVE-2025-24893

PoC for CVE-2025-24893: XWiki' Remote Code Execution exploit for versions prior to 15.10.11, 16.4.1 and 16.5.0RC1.

dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC

CVE-2025-24893 is a critical unauthenticated remote code execution vulnerability in XWiki (versions < 15.10.11, 16.4.1, 16.5.0RC1) caused by improper

b0ySie7e/CVE-2025-24893

PoC CVE-2025-24893 — b0ySie7e/CVE-2025-24893

iSee857/CVE-2025-24893-PoC

XWiki SolrSearchMacros 远程代码执行漏洞PoC（CVE-2025-24893）

Hex00-0x4/CVE-2025-24893-XWiki-RCE

This vulnerability could allow a malicious user to execute remote code by sending appropriately crafted requests to the default search engine SolrSear

Infinit3i/CVE-2025-24893

PoC exploits CVE-2025-24893 , a remote code execution (RCE) vulnerability in XWiki caused by improper sandboxing in Groovy macros rendered asynchronou

hackersonsteroids/cve-2025-24893

Modified exploit for CVE-2025-24893

AliElKhatteb/CVE-2024-32019-POC

this is a poc for the CVE-2025-24893

D3Ext/CVE-2025-24893

POC exploit for CVE-2025-24893

nopgadget/CVE-2025-24893

PoC CVE-2025-24893 — nopgadget/CVE-2025-24893

10 repos — triés par ⭐ Rechercher sur GitHub ↗

RondoDox Exploits Unpatched XWiki Servers to Pull More Devices Into Its Botnet

TheHackerNews Nov 15, 2025

Active Exploits Hit Dassault and XWiki — CISA Confirms Critical Flaws Under Attack

TheHackerNews Oct 29, 2025

RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers

TheHackerNews Jan 01, 2026

Signal Intelligence

Confidenceⓘ

92%

EPSS 93.75%

Mentions 3

Last Seen Jan 01, 2026

CNA Information

Analyst Note

CVE-2025-24893 shows clear zero-day characteristics: published 2025-02-20, actively exploited in the wild by RondoDox botnet targeting unpatched XWiki instances within weeks of disclosure, and explicitly named in CISA alerts as 'under attack'. The very short window between publication and documented exploitation, combined with critical CVSS 9.8 severity and active threat actor targeting, confirms zero-day status.

Threat Actors 5

Cobalt

apt_group Financial crime 🇷🇺 RU

Hacking Team

apt_group 🇮🇹 IT

Red October

apt_group 🇷🇺 RU

Operation Red Signature

apt_group Information theft and espionage 🇨🇳 CN

Mana Team

apt_group 🇨🇳 CN

Triage Info

Decided atMar 05, 2026