Skip to contentMediawiki vulnerabilities
Newest
- mediawikiCodex Special:Block vulnerable to message key XSSCVE-2025-61636Fix available0.0 None
- mediawikiAction API xslt option allows JavaScript execution by administrators who are not interface administratorsCVE-2025-67484Fix available0.0 None
- mediawikimw.message(…).parse() doesn't output safe HTML, but it's being used as if it doesCVE-2025-67481Fix available0.0 None
- mediawikilist=allrevisions can be used to bypass Extension:LockdownCVE-2025-67480Fix available0.0 None
- mediawiki checkuserWrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"CVE-2025-67478Fix available0.0 None
- mediawikiStored XSS through edit summaries in MW CoreCVE-2025-67475Fix available0.0 None
- wikimedia foundation visualeditor, mediawiki visual editor +1 moreXSS when pasting into VECVE-2025-61656Fix available0.0 None
- wikimedia foundation visualeditor, mediawiki visual editor +1 moreStored XSS through system messages in VisualEditorCVE-2025-61655Fix available0.0 None
- mediawikiWatchlist group mode reveals authors of edits with hidden authorshipCVE-2025-61646Fix available1.2 Low
- mediawikiEventStreams publishes suppressed recent change entries that are suppressed from their creationCVE-2025-61643Fix available2.7 Low
- mediawikiAPI list=allpages with maxsize is making really slow queriesCVE-2025-61641Fix available1.7 Low
- mediawikiStored XSS through system messages in Special:RecentChangesLinked (MW Core)CVE-2025-61640Fix available0.0 None
- mediawikiSuppressed blocked IP is visible in Special:BlockList, RC, and other placesCVE-2025-61639Fix available1.7 Low
- mediawiki, wikimedia parsoid +1 moreSanitizer::validateAttributes data-XSSCVE-2025-61638Public exploitFix available0.0 None
- mediawikiStored i18n XSS exposed by security patch for T402077CVE-2025-11261Fix available0.0 None
- mediawiki cargo, the wikimedia foundation mediawiki - cargo, wikimedia mediawiki-cargo +2 moreVarious XSSes found in CargoCVE-2024-47847Fix available6.9 Medium
- mediawiki cargo, the wikimedia foundation mediawiki - cargo, wikimedia mediawiki-cargo +2 moreSpecial:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protectionCVE-2024-478466.9 Medium
- mediawiki cargo, the wikimedia foundation mediawiki - cargo, wikimedia mediawiki-cargo +2 moreBackticks can allow the usage of not-allowed SQL functionsCVE-2024-478498.8 High
- mediawikiImproper permissions handling in MediaWiki AbuseFilterCVE-2024-47913Fix available5.3 Medium
- mediawikiAn issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS...CVE-2024-40605Fix available4.8 Medium
- mediawikiAn issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via...CVE-2024-40604Fix available4.8 Medium
- mediawikiAn issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special...CVE-2024-40603Fix available4.3 Medium
- mediawikiAn issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via...CVE-2024-40602Fix available4.8 Medium
- mediawikiAn issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can...CVE-2024-40601Fix available6.5 Medium
- mediawiki, mediawiki metrolook skin +1 moreAn issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS...CVE-2024-40600Fix available4.8 Medium
- mediawikiAn issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via...CVE-2024-40599Fix available4.8 Medium
- mediawikiAn issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can...CVE-2024-40598Fix available4.3 Medium
- mediawikiAn issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose...CVE-2024-40597Fix available7.5 High
- mediawikiAn issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special...CVE-2024-40596Fix available4.3 Medium
- mediawiki, fedoraproject fedora +1 moreAn issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7...CVE-2024-34507Fix available7.4 High
- mediawiki, fedoraproject fedora +1 moreAn issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1...CVE-2024-34502Fix available9.8 Critical
- mediawiki, fedoraproject fedora +1 moreMediaWiki UnlinkedWikibase Cross-site Scripting vulnerabilityCVE-2024-34500Fix available6.1 Medium
- mediawikiAn issue was discovered in VectorComponentUserLinks.php in the Vector Skin component in MediaWiki...CVE-2023-45361Fix available6.1 Medium
- mediawiki vector skinAn issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x...CVE-2023-45359Fix available6.5 Medium
- mediawiki, fedoraproject fedora +1 moreAn issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40...CVE-2024-34506Fix available7.5 High
- mediawikiAn issue was discovered in the Cargo extension for MediaWiki through 1.39.3. There is mishandling...CVE-2023-291348.6 High
- mediawikiAn issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special...CVE-2024-23179Fix available6.1 Medium
- mediawikiAn issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js...CVE-2024-23178Fix available5.4 Medium
- mediawikiAn issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur...CVE-2024-23177Fix available6.1 Medium
- mediawikiAn issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1...CVE-2024-23174Fix available5.4 Medium
- mediawikiMediaWiki Cargo Extension Cross-site Scripting vulnerabilityCVE-2024-23173Fix available6.1 Medium
- mediawikiAn issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1...CVE-2024-23172Fix available5.4 Medium
- mediawikiAn issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x...CVE-2024-23171Fix available5.4 Medium
- mediawikiAn issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1...CVE-2023-51704Fix available6.1 Medium
- mediawikiAn issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39...CVE-2023-45362Fix available4.3 Medium
- mediawikiAn issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1...CVE-2023-45360Fix available5.4 Medium
- mediawikiAn issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through...CVE-2023-45374Fix available5.3 Medium
- mediawikiAn issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x...CVE-2023-45373Fix available6.1 Medium
- mediawikiAn issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1...CVE-2023-45372Fix available5.3 Medium
- mediawikiAn issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1...CVE-2023-45371Fix available7.5 High
- Show moreLoading…