Skip to contentWikimedia Foundation Mediawiki vulnerabilities
- wikimedia foundation mediawiki - ipinfo extensionDenial of service vector on ipinfo/v0/norevisionCVE-2025-534817.5 High
- malvineous masseditregex, wikimedia foundation mediawiki - masseditregex extension +1 moreStored XSS in MassEditRegexCVE-2025-535005.6 Medium
- wikimedia foundation mediawiki - scribunto extension, xtex scribunto +1 moreContent Access Bypass in ScribuntoCVE-2025-535018.8 High
- wikimedia foundation mediawiki - featuredfeeds extensionHTML injection in FeaturedFeedsCVE-2025-535026.5 Medium
- jackphoenix googledocs4mw, wikimedia foundation mediawiki - googledocs4mw extension +1 moreXSS in GoogleDocs4MWCVE-2025-534895.6 Medium
- jly campaignevents, the wikimedia foundation mediawiki - campaignevents extension +1 moreMultiple XSS in CampaignEventsCVE-2025-534905.6 Medium
- the wikimedia foundation mediawiki - centralauth extensionSecurity Authentication Bypass in CentralAuthCVE-2025-6926Fix available8.8 High
- wikimedia foundation mediawikiMediaWiki should not consider autocreation as login for the purposes of security reauthenticationCVE-2025-6597Fix available0.0 None
- wikimedia foundation mediawikiXSS in Special:ApiSandboxCVE-2025-6594Fix available0.0 None
- wikimedia foundation mediawiki"{{SITENAME}} registered email address has been changed" email sent to unverified email addressesCVE-2025-6593Fix available2.1 Low
- wikimedia foundation mediawikiHTML injection in API action=feedcontributions output from i18n messageCVE-2025-6591Fix available0.0 None
- wikimedia foundation mediawikiComplete content leak of private wikis due to PasswordReset Wikitext injection in error messageCVE-2025-6590Fix available4.6 Medium
- wikimedia foundation mediawiki - mintydocs extension, yaronkoren mintydocs +1 moreStored XSS in MintyDocsCVE-2025-534923.7 Low
- wikimedia foundation mediawiki - mintydocs extension, yaronkoren mintydocs +1 moreStored XSS in MintyDocsCVE-2025-534936.5 Medium
- wikimedia foundation mediawiki - twocolconflict extension, wmde-fisch twocolconflict +1 moreStored XSS in TwoColConflictCVE-2025-534946.5 Medium
- wikimedia foundation mediawikiAbuseFilter log interfaces expose global private and hidden filters when central DB is not availableCVE-2025-32700Fix available2.3 Low
- wikimedia foundation mediawiki, parsoid +1 morePotential javascript injection attack enabled by Unicode normalization in Action APICVE-2025-32699Fix available2.1 Low
- wikimedia foundation mediawikiLogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictionsCVE-2025-32698Fix available2.1 Low
- wikimedia foundation mediawikiCascading protection is not preventing file reversionsCVE-2025-32697Fix available0.0 None
- wikimedia foundation mediawiki"reupload-own" restriction can be bypassed by reverting fileCVE-2025-32696Fix available0.0 None
- wikimedia foundation mediawikii18n XSS vulnerability in HTMLMultiSelectField when sections are usedCVE-2025-3469Fix available0.0 None
- wikimedia foundation mediawiki - socialprofile extensionSpecial:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed)CVE-2025-230742.4 Low
- wikimedia foundation mediawiki - globalblocking extensionAPI list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameterCVE-2025-230733.5 Low
- wikimedia foundation mediawiki - refreshspecial extensionXSS in Special:RefreshSpecialCVE-2025-230725.4 Medium
- wikimedia foundation mediawiki - datatransfer extensionVarious security vulnerabilities in Extension:DataTransferCVE-2025-23081Fix available6.1 Medium
- wikimedia foundation mediawiki - openbadges extensionXSSes in Special:BadgeViewCVE-2025-230805.3 Medium
- wikimedia foundation mediawiki - articlefeedbackv5 extensionXSSes in Extension:ArticleFeedbackv5CVE-2025-230796.1 Medium
- wikimedia foundation mediawiki - breadcrumbs2 extensionXSS in BreadCrumbs2CVE-2025-230786.5 Medium
- the wikimedia foundation mediawiki - css extension, wikimedia mediawiki-extensions-css, wikimedia-extensions-css +2 morePath traversal when loading stylesheetsCVE-2024-47841EPSS 34.6%6.9 Medium
- the wikimedia foundation mediawiki - css extension, wikimedia mediawiki-extensions-css, wikimedia-extensions-css +2 moreCSS sanitizer used incorrectly, and is easily bypassedCVE-2024-478456.9 Medium
- mediawiki, debian linux +1 moreStored XSS leads to privilege escalation in MediaWiki v1.40.0CVE-2023-3550Fix available7.3 High
- mediawikiMediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1)...CVE-2012-4381Fix available8.1 High
- mediawikiThe CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1...CVE-2013-64555.3 Medium
- mediawiki, debian linux, fedoraproject fedora +1 more +3 moreMediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which...CVE-2013-1817Fix available7.5 High
- mediawiki, debian linux, fedoraproject fedora +1 more +3 moreMediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of...CVE-2013-1816Fix available7.5 High
- ikimedia foundation mediawiki, debian linux +1 moreA cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4...CVE-2013-1951Fix available6.1 Medium
- mediawikimediawiki allows deleted text to be exposedCVE-2012-0046Fix available7.5 High
- mediawikiTarball was missing .htaccess filesCVE-2018-13258Fix available5.3 Medium
- mediawiki, debian linux +1 moreBotPasswords can bypass CentralAuth's account lockCVE-2018-0505Fix available6.5 Medium
- mediawiki, debian linux +1 moreInformation disclosure in Special:Redirect/logidCVE-2018-0504Fix available6.5 Medium
- mediawiki, debian linux +1 more$wgRateLimits entry for 'user' overrides 'newbie'CVE-2018-0503Fix available4.3 Medium
- mediawiki, debian linux +1 moreHaving LocalisationCache directory default to system tmp directory is insecureCVE-2017-0367Fix available8.8 High
- mediawiki, debian linux +1 moreSpam blacklist ineffective on encoded URLs inside file inclusion syntax's link parameterCVE-2017-0370Fix available5.3 Medium
- mediawiki, debian linux +1 moreSysops can undelete pages, although the page is protected against itCVE-2017-0369Fix available6.5 Medium
- mediawiki, debian linux +1 moreMake rawHTML mode not apply to system messagesCVE-2017-0368Fix available5.3 Medium
- mediawiki, debian linux +1 moreSVG filter evasion using default attribute values in DTD declarationCVE-2017-0366Fix available5.4 Medium
- mediawiki, debian linux +1 moreXSS in SearchHighlighter::highlightText() [requires non-default config]CVE-2017-0365Fix available4.7 Medium
- mediawiki, debian linux +1 moreSpecial:Search allows redirects to any interwiki linkCVE-2017-0364Fix available6.1 Medium
- mediawiki, debian linux +1 moreSpecial:UserLogin?returnto=interwiki:foo will redirect to external sitesCVE-2017-0363Fix available6.1 Medium
- mediawiki, debian linux +1 more"Mark all pages visited" on the watchlist does not require a CSRF tokenCVE-2017-0362Fix available8.8 High
- Show moreLoading…