VulnRadar

Data against noise.

Built with NaN
Page generated: 07 Nov 2026, 05:23 UTC
← Dashboard

CVE-2025-24893

React2Shell

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki instal…

Read full description
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution through a request to `SolrSearch`. This impacts the confidentiality, integrity and availability of the whole XWiki installation. To reproduce on an instance, without being logged in, go to `<host>/xwiki/bin/get/Main/SolrSearch?media=rss&text=%7D%7D%7D%7B%7Basync%20async%3Dfalse%7D%7D%7B%7Bgroovy%7D%7Dprintln%28"Hello%20from"%20%2B%20"%20search%20text%3A"%20%2B%20%2823%20%2B%2019%29%29%7B%7B%2Fgroovy%7D%7D%7B%7B%2Fasync%7D%7D%20`. If there is an output, and the title of the RSS feed contains `Hello from search text:42`, then the instance is vulnerable. This vulnerability has been patched in XWiki 15.10.11, 16.4.1 and 16.5.0RC1. Users are advised to upgrade. Users unable to upgrade may edit `Main.SolrSearchMacros` in `SolrSearchMacros.xml` on line 955 to match the `rawResponse` macro in `macros.vm#L2824` with a content type of `application/xml`, instead of simply outputting the content of the feed.
CVSS 9.8 (CRITICAL) KEV: KNOWN CATALOG

Attention and evidence

HYPE SCORE
0.0/10
REALITY · THREAT PRIORITY
9.0/10
General review priority; not probability

Evidence confidence: Exploitation recorded

Why this priority?
  • Recorded exploitation baseline: +7.00
  • Technical severity: CVSS 9.8: +1.47
  • Fresh EPSS: 99.97%: +0.50

General review priority, not probability, victim count or asset-specific risk. A range covers missing CVSS/EPSS inputs within the current evidence state.

Sources: 35 documents and public datasets.

Hype components

Headline sample (25%)
0/100
Press, 30 days (60%)
0/100
Grounded branding (15%)
0/100
HYPE TOTAL0/100

Sources and documents

BleepingComputer
Press · 05 Apr 2026, 07:00 · Hackers exploit React2Shell in automated credential theft campaign - BleepingComputer
SecurityWeek
Press · 03 Apr 2026, 07:00 · React2Shell Exploited in Large-Scale Credential Harvesting Campaign - SecurityWeek
Cybersecurity Dive
Press · 04 Feb 2026, 08:00 · React2Shell exploitation undergoes significant change in threat activity - Cybersecurity Dive
SecurityWeek
Press · 02 Jan 2026, 08:00 · RondoDox Botnet Exploiting React2Shell Vulnerability - SecurityWeek
The Hacker News
Press · 01 Jan 2026, 08:00 · RondoDox Botnet Exploits Critical React2Shell Flaw to Hijack IoT Devices and Web Servers - The Hacker News
See all 35 source documents
Bitsight
Press · 18 Dec 2025, 08:00 · CVE-2025-55182: First Days of React2Shell Exploitations - Bitsight
CyberScoop
Press · 17 Dec 2025, 08:00 · React2Shell fallout spreads to sensitive targets as public exploits hit all-time high - CyberScoop
The Hacker News
Press · 16 Dec 2025, 08:00 · React2Shell Vulnerability Actively Exploited to Deploy Linux Backdoors - The Hacker News
Microsoft
Press · 15 Dec 2025, 08:00 · Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components - Microsoft
Google Cloud
Press · 12 Dec 2025, 08:00 · Multiple Threat Actors Exploit React2Shell (CVE-2025-55182) - Google Cloud
Cloudflare Blog
Press · 11 Dec 2025, 08:00 · React2Shell and related RSC vulnerabilities threat brief: early exploitation activity and threat actor techniques - Cloudflare Blog
Sophos
Press · 11 Dec 2025, 08:00 · React2Shell flaw (CVE-2025-55182) exploited for remote code execution - Sophos
OX Security
Press · 11 Dec 2025, 08:00 · React2Shell | Going Granular: A Deep-Deep-Deep Technical Analysis of CVE-2025-55182 - OX Security
www.trendmicro.com
Press · 10 Dec 2025, 08:00 · CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation - www.trendmicro.com
Huntress
Press · 09 Dec 2025, 08:00 · PeerBlight Linux Backdoor Exploits React2Shell CVE-2025-55182 - Huntress
Recorded Future
Press · 08 Dec 2025, 08:00 · Critical React2Shell Vulnerability Under Active Exploitation by Chinese Threat Actors - Recorded Future
wiz.io
Press · 08 Dec 2025, 08:00 · React2Shell: Technical Deep-Dive & In-the-Wild Exploitation of CVE-2025-55182 - wiz.io
Infosecurity Magazine
Press · 05 Dec 2025, 08:00 · React.js Hit by Maximum-Severity 'React2Shell' Vulnerability - Infosecurity Magazine
Check Point Blog
Press · 05 Dec 2025, 08:00 · What is “React2Shell” (CVE-2025-55182) - in Plain English - and Why Check Point CloudGuard WAF Customers Carried on with Their Day - Check Point Blog
SecurityWeek
Press · 05 Dec 2025, 08:00 · Chinese Hackers Exploiting React2Shell Vulnerability - SecurityWeek
Sonatype
Press · 04 Dec 2025, 08:00 · Serious React2Shell Vulnerabilities Require Immediate Attention - Sonatype
Rapid7
Press · 04 Dec 2025, 08:00 · React2Shell (CVE-2025-55182) - Critical unauthenticated RCE affecting React Server Components - Rapid7
Amazon Web Services (AWS)
Press · 04 Dec 2025, 08:00 · China-nexus cyber threat groups rapidly exploit React2Shell vulnerability (CVE-2025-55182) - Amazon Web Services (AWS)
SecurityWeek
Press · 04 Dec 2025, 08:00 · React2Shell: In-the-Wild Exploitation Expected for Critical React Vulnerability - SecurityWeek
wiz.io
Press · 03 Dec 2025, 08:00 · React2Shell (CVE-2025-55182): Everything You Need to Know About the Critical React Vulnerability - wiz.io
SentinelOne
Press · 03 Dec 2025, 08:00 · From React to Remote Code – Protecting Against the Critical React2Shell RCE Exposure - SentinelOne
CyberSecurityNews
Press · 17 Nov 2025, 08:00 · Hackers Exploiting XWiki Vulnerability in the Wild to Hire the Servers for Botnet - CyberSecurityNews
SecurityWeek
Press · 17 Nov 2025, 08:00 · Widespread Exploitation of XWiki Vulnerability Observed - SecurityWeek
Recorded Future
Press · 06 Nov 2025, 08:00 · October 2025 CVE Landscape: 32 High-Impact Vulnerabilities Demand Immediate Attention - Recorded Future
Cyber Daily
Press · 04 Nov 2025, 08:00 · Xwiki and VMWare vulnerabilities exploited in the wild - Cyber Daily
GBHackers News
Press · 29 Oct 2025, 07:00 · XWiki Remote Code Execution Flaw Actively Weaponized for Coinmining - GBHackers News
Hackread
Press · 29 Oct 2025, 07:00 · Hackers Hijack Corporate XWiki Servers for Crypto Mining - Hackread
The Hacker News
Press · 29 Oct 2025, 07:00 · Active Exploits Hit Dassault and XWiki — CISA Confirms Critical Flaws Under Attack - The Hacker News
CyberSecurityNews
Press · 28 Oct 2025, 07:00 · XWiki RCE Vulnerability Actively Exploted In Wild To Deliver Coinminer - CyberSecurityNews
Rapid7
Press · 05 Sep 2025, 07:00 · Metasploit Weekly Wrap-Up 09/05/2025 - Rapid7

Score evolution

● Hype   ● Reality

Earlier evidence-support scores are retained in history; this chart shows only the current priority definition.

First record: hype 0.0 · reality 9.0 (2026-11-02 15:13). The curve appears once the score changes.

Public exploit evidence

23

Public exploit entries / repo candidates

See 23 repos with metrics
RepositoryStarsForksLanguageUpdated
gunzf0x/CVE-2025-24893234Python22 Aug 2025, 05:34
dollarboysushil/CVE-2025-24893-XWiki-Unauthenticated-RCE-Exploit-POC171Python04 Aug 2025, 16:53
iSee857/CVE-2025-24893-PoC102Python01 Apr 2025, 08:47
Infinit3i/CVE-2025-2489361Python02 Sep 2025, 15:30
AliElKhatteb/CVE-2024-32019-POC52C03 Aug 2025, 11:45
D3Ext/CVE-2025-2489342Python09 Aug 2025, 16:22
570RMBR3AK3R/xwiki-cve-2025-24893-poc31Python06 Aug 2025, 18:57
BreakingRohit/CVE-2025-24893-PoC20Python28 Dec 2025, 18:49
torjan0/xwiki_solrsearch-rce-exploit20Python29 Nov 2025, 23:01
80Ottanta80/CVE-2025-24893-PoC10Python11 Nov 2025, 23:26
Th3Gl0w/CVE-2025-24893-POC10TypeScript09 Aug 2025, 12:49
x0da6h/POC-for-CVE-2025-2489310Python20 Sep 2025, 10:13
alaxar/CVE-2025-2489300Python08 Aug 2025, 20:19
CMassa/CVE-2025-2489300Python15 Aug 2025, 16:16
dhiaZnaidi/CVE-2025-24893-PoC00Python03 Aug 2025, 11:59
Fomovet/cve-2025-2489300Python21 Jun 2026, 14:30
gmh5225/CVE-2025-24893-RCE-PoC00—03 Aug 2025, 14:20
hitchy22/xwiki-exploit01Python14 Oct 2026, 06:57
investigato/cve-2025-24893-poc01Rust07 Aug 2025, 12:51
mah4nzfr/CVE-2025-2489300Shell31 Aug 2025, 11:28
Retro023/CVE-2025-24893-POC00Python26 Jan 2026, 17:38
The-Red-Serpent/CVE-2025-2489300Python08 Aug 2025, 09:50
zs1n/CVE-2025-2489300Python05 Aug 2025, 07:45
Public exploit evidence
Evidence context and dated references

Reality is general threat/review priority, combining observed exploitation, CVSS severity and fresh EPSS. Evidence confidence is separate. This is not calibrated risk, a victim count or an asset-specific assessment. A range reflects missing numeric inputs.

Evidence in context

Confidence in exploitation evidence
Exploitation recorded
Priority basis
Recorded exploitation; CVSS 9.8; EPSS 100.0%
Attention, last 30 days
0 distinct story titles; 0 press documents; 0 publisher domains.
Technical potential
network access, no prior privileges, no user interaction.
Observed activity
Exploitation recorded in CISA KEV.
Known scale
Not quantified.
Evidence confidence basis
Trusted exploitation confirmation

Score evaluated: 2026-11-05 13:59:31.695937+00:00 · EPSS snapshot: 2026-11-05T12:03:04Z

Source event timeline
Published
20 Feb 2025, 19:19
First press mention
05 Sep 2025, 07:00
Added to the CISA KEV catalog
30 Oct 2025, 00:00
Latest press mention
05 Apr 2026, 07:00
Score calculated
05 Nov 2026, 13:59
Name
React2Shell
PoCs on GitHub
23 repositories
Source: CVE List V5 · CISA KEV · FIRST EPSS · GitHub · RSSVulnRadar