Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 527

Export CSV
CVE-2025-6597

MediaWiki should not consider autocreation as login for the purposes of security reauthentication

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-11937

Stored XSS through a system message in SecurePoll

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Extension allows Stored XSS.This issue affects Mediawiki - SecurePoll Extension: master.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2025-62661

Do permission checking when getting counts of global and local edits, new articles and thanks

Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension: from 1.43 before 1.44.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2025-12004

The compare API module breaks Extension:Lockdown

Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2025-62662

Stored XSS through system messages in AdvancedSearch

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master before 1.39.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2025-62696

Multiple critical security issues in Springboard

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Mediawiki Foundation - Springboard Extension: master.

CVSS 4.0 · 6.9 Medium EPSS 1.4% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2024-47812

Cross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDump

ImportDump is an extension for mediawiki designed to automate user import requests. Anyone who can edit the interface strings of a wiki (typically administrators and interface admins) can embed XSS payloads in the messages for dates, and thus XSS anyone who views Special:RequestImportQueue. This issue has been patched in commit `d054b95` and all users are advised to apply this commit to their branch. Users unable to upgrade may either Prevent access to Special:RequestImportQueue on all wikis, except for the global wiki; and If an interface administrator (or equivalent) level protection is available (which is not provided by default) on the global wiki, protect the affected messages up to that level. This causes the XSS to be virtually useless as users with those rights can already edit Javascript pages. Or Prevent access to Special:RequestImportQueue altogether.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2025-62664

Stored XSS through a system message in ImageRating

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ImageRating Extension allows Stored XSS.This issue affects Mediawiki - ImageRating Extension: from master before 1.39.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2025-62663

Stored XSS through a system message in UploadWizard

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard Extension allows Stored XSS.This issue affects Mediawiki - UploadWizard Extension: from master before 1.39.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2025-62657

Stored XSS through system messages in PageForms

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS.This issue affects MediaWiki PageForms extension: 1.44.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki Pageforms
CVE-2024-47612

XSS in Special:DataDump when displaying dump status

DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (datadump-table-column-in-progress), (datadump-table-column-completed), (datadump-table-column-failed)). If these messages are edited (which requires the (editinterface) right by default), anyone who can view Special:DataDump (which requires the (view-dump) right by default) can be XSSed. This vulnerability is fixed with 601688ee8e8808a23b102fa305b178f27cbd226d.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Miraheze
Products
Mediawiki Datadump
CVE-2025-62658

SQL injection in WatchAnalytics through Special:ClearPendingReviews

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extension allows SQL Injection.This issue affects MediaWiki WatchAnalytics extension: 1.43, 1.44.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki Watchanalytics
CVE-2025-62659

The CookieConsent extension does not properly use reserved data attributes, thus introducing potential XSS vectors

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki CookieConsent extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki CookieConsent extension: from v0.1.0 before v2.0.0.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Cookieconsent Mediawiki
CVE-2025-62656

GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki GlobalBlocking extension allows Stored XSS.This issue affects MediaWiki GlobalBlocking extension: 1.43, 1.44.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Globalblocking Mediawiki
CVE-2025-62666

DoS vector through the cirrusbuilddoc query API

Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue affects Mediawiki - CirrusSearch Extension: from master before 1.43.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2025-6594

XSS in Special:ApiSandbox

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-6927

Autoblocks from global account suppressions are publicly visible

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php, includes/api/ApiQueryBlocks.Php. This issue affects MediaWiki: from >= 1.42.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-62698

Stored XSS through system messages in ExternalGuidance

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuidance allows Stored XSS.This issue affects Mediawiki - ExternalGuidance: from master before 1.39.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Externalguidance Mediawiki
CVE-2025-7057

Stored XSS in Quiz

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Quiz Extension allows Stored XSS.This issue affects Mediawiki - Quiz Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2025-6926

Security Authentication Bypass in CentralAuth

Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki