Skip to contentMediawiki Mediawik vulnerabilities
- mediawiki, debian linux, fedoraproject fedora +2 moreIn MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can...CVE-2020-35475Fix available7.5 High
- mediawikiincludes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS...CVE-2020-29002Fix available4.8 Medium
- mediawikiThe PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll...CVE-2020-29003Fix available5.4 Medium
- mediawikiThe RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title...CVE-2020-27957Fix available5.4 Medium
- mediawikiThe FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user...CVE-2020-27621Fix available4.3 Medium
- mediawiki, fedoraproject fedora +1 moreAn information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1...CVE-2020-25869Fix available7.5 High
- mediawiki, fedoraproject fedora +1 moreMediaWiki Cross-site Scripting (XSS) vulnerabilityCVE-2020-25815Fix available6.1 Medium
- mediawiki, fedoraproject fedora +1 moreAn issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker...CVE-2020-26121Fix available7.5 High
- mediawiki, fedoraproject fedora +1 moreXSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is...CVE-2020-26120Fix available6.1 Medium
- mediawiki, fedoraproject fedora +1 moreMediaWiki Cross-site Scripting (XSS) vulnerabilityCVE-2020-25828Fix available6.1 Medium
- mediawiki, fedoraproject fedora +1 moreOATHAuth extension in MediaWiki is not implementing rate limitCVE-2020-25827Fix available7.5 High
- mediawiki, fedoraproject fedora +1 moreMediaWiki Cross-site Scripting (XSS) vulnerabilityCVE-2020-25814Fix available6.1 Medium
- mediawiki, fedoraproject fedora +1 moreMediaWiki Special:UserRights exposes the existence of hidden usersCVE-2020-25813Fix available5.3 Medium
- mediawiki, fedoraproject fedora +1 moreMediaWiki Cross-site Scripting (XSS) vulnerabilityCVE-2020-25812Fix available6.1 Medium
- mediawiki, debian linux, fedoraproject fedora +2 moreimg_auth.php may leak private extension images into the public cacheCVE-2020-15005Fix available3.1 Low
- mediawikiMediaWiki Open Redirect vulnerabilityCVE-2020-10959Fix available6.1 Medium
- mediawikiThe CentralAuth extension through REL1_34 for MediaWiki allows remote attackers to obtain...CVE-2020-120517.5 High
- mediawikiMediaWiki makeCollapsible allows applying event handler to any CSS selectorCVE-2020-10960Fix available5.3 Medium
- mediawikiIn the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related...CVE-2020-10534Fix available9.8 Critical
- mediawikiMediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1)...CVE-2012-4381Fix available8.1 High
- mediawikiThe CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1...CVE-2013-64555.3 Medium
- mediawiki, scribunto +1 moreThe Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and...CVE-2014-94815.9 Medium
- mediawikiThe WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax...CVE-2020-6163Fix available6.1 Medium
- mediawikiThe MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles...CVE-2019-199106.1 Medium
- mediawiki, debian linux +1 morePossible to circumvent title-blacklistCVE-2019-19709Fix available6.1 Medium
- mediawiki, debian linux, fedoraproject fedora +1 more +3 moreMediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which...CVE-2013-1817Fix available7.5 High
- mediawiki, debian linux, fedoraproject fedora +1 more +3 moreMediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of...CVE-2013-1816Fix available7.5 High
- ikimedia foundation mediawiki, debian linux +1 moreA cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4...CVE-2013-1951Fix available6.1 Medium
- mediawikimediawiki allows deleted text to be exposedCVE-2012-0046Fix available7.5 High
- mediawiki, debian linux, fedoraproject fedora +2 moreMediaWiki information disclosureCVE-2019-16738Fix available5.3 Medium
- mediawiki, debian linux +1 moreWikimedia information leak vulnerabilityCVE-2019-12474Fix available7.5 High
- mediawiki, debian linux +1 moreWikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultipleCVE-2019-12473Fix available7.5 High
- mediawikiMediaWiki Incorrect Access Control vulnerabilityCVE-2019-12472Fix available7.5 High
- mediawiki, debian linux +1 moreMediaWiki Cross-site Scripting (XSS)CVE-2019-12471Fix available6.1 Medium
- mediawiki, debian linux +1 moreWikimedia MediaWik exposed suppressed log in RevisionDelete pageCVE-2019-12470Fix available6.5 Medium
- mediawiki, debian linux +1 moreMediaWiki Incorrect Access Control vulnerabilityCVE-2019-12469Fix available6.5 Medium
- mediawiki, debian linux +1 moreWikimedia MediaWiki Incorrect Access Control vulnerabilityCVE-2019-12468Fix available9.8 Critical
- mediawiki, debian linux +1 moreMediaWiki Incorrect Access Control vulnerabilityCVE-2019-12467Fix available5.3 Medium
- mediawiki, debian linux +1 moreWikimedia MediaWiki allows CSRFCVE-2019-12466Fix available8.8 High
- mediawikiTarball was missing .htaccess filesCVE-2018-13258Fix available5.3 Medium
- mediawiki, debian linux +1 moreBotPasswords can bypass CentralAuth's account lockCVE-2018-0505Fix available6.5 Medium
- mediawiki, debian linux +1 moreInformation disclosure in Special:Redirect/logidCVE-2018-0504Fix available6.5 Medium
- mediawiki, debian linux +1 more$wgRateLimits entry for 'user' overrides 'newbie'CVE-2018-0503Fix available4.3 Medium
- mediawikiMediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to...CVE-2014-16865.3 Medium
- mediawiki, debian linux, mediawiki (syntaxhighlight extension) +2 moreParameters injection in SyntaxHighlight results in multiple vulnerabilitiesCVE-2017-0372Public exploitFix availableEPSS 11.3%9.8 Critical
- mediawiki, debian linux +1 moreHaving LocalisationCache directory default to system tmp directory is insecureCVE-2017-0367Fix available8.8 High
- mediawiki, fedoraproject fedora +1 moreThe OAuth extension for MediaWiki improperly negotiates a new client token only over Special...CVE-2015-80087.5 High
- mediawiki, debian linux +1 moreThe language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2...CVE-2017-8815Fix available7.5 High
- mediawiki, debian linux +1 moreThe language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2...CVE-2017-8814Fix available7.5 High
- mediawiki, debian linux +1 moreMediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers...CVE-2017-8812Fix available5.3 Medium
- Show moreLoading…