Skip to contentMiraheze vulnerabilities
Newest
- miraheze tsportalTSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of ServiceCVE-2026-33541Fix available6.5 Medium
- miraheze tsportalTSPortal: Anyone can forge self-deletion requests of any userCVE-2026-29788Fix available8.4 High
- miraheze discordnotificationsDiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLsCVE-2025-533719.1 Critical
- miraheze managewikiManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflectionCVE-2025-438614.4 Medium
- miraheze managewikiManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensionsCVE-2025-329644.6 Medium
- miraheze managewikiManageWiki has SQL injection vulnerability in NamespaceMigrationJobCVE-2025-329568.0 High
- miraheze incidentreportingCross-site Scripting in IncidentReportingCVE-2024-478156.0 Medium
- miraheze importdumpUsers can impersonate import requesters if their actor IDs coincide in ImportDumpCVE-2024-478166.4 Medium
- miraheze importdumpCross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDumpCVE-2024-478126.0 Medium
- miraheze createwikiCross-site Scripting (XSS) in Special:RequestWikiQueue when displaying sitename in CreateWikiCVE-2024-477815.3 Medium
- miraheze wikidiscoverCross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscoverCVE-2024-477827.6 High
- miraheze datadumpXSS in Special:DataDump when displaying dump statusCVE-2024-476123.5 Low
- miraheze createwikiCreateWiki vulnerable to impersonation of wiki requesterCVE-2024-347015.9 Medium
- miraheze createwikiOversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikisCVE-2024-298984.9 Medium
- miraheze createwikiCreateWiki Leak of suppressed wiki requests outside of `CreateWikiGlobalWiki`CVE-2024-298974.9 Medium
- miraheze createwikiCreateWiki's wiki request suppression ignores the suppression settings set by the suppressorCVE-2024-298834.9 Medium
- miraheze managewikiCross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWikiCVE-2024-251096.5 Medium
- miraheze wikidiscoverCross-Site Scripting in WikiDiscoverCVE-2024-251074.9 Medium
- miraheze createwikiAuthentication Bypass Using an Alternate Path or Channel in CreateWikiCVE-2022-248135.3 Medium
- miraheze globalnewfilesImproper Input Validation in GlobalNewFilesCVE-2021-391864.3 Medium
- miraheze datadumpCross-Site Request Forgery (CSRF) in DataDumpCVE-2021-327746.1 Medium
- miraheze globalnewfilesUncontrolled Resource Consumption in GlobalNewFilesCVE-2021-327226.5 Medium
- miraheze managewikiwikiconfig API leaked private config variables set through ManageWikiCVE-2021-294839.4 Critical