Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 495

Export CSV
CVE-2025-61641

API list=allpages with maxsize is making really slow queries

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61642

Stored XSS through system messages provided to CodexHtmlForms

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/CodexHTMLForm.Php, includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61643

EventStreams publishes suppressed recent change entries that are suppressed from their creation

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-11261

Stored i18n XSS exposed by security patch for T402077

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61646

Watchlist group mode reveals authors of edits with hidden authorship

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61634

HTML rest endpoint needs PoolCounter and proper parser cache check

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61636

Codex Special:Block vulnerable to message key XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61637

Stored XSS through system messages in MW Core

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61638

Sanitizer::validateAttributes data-XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Parsoid: from * before 0.16.6, 0.20.4, 0.21.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Parsoid
CVE-2025-61639

Suppressed blocked IP is visible in Special:BlockList, RC, and other places

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/ManualLogEntry.Php, includes/recentchanges/RecentChangeFactory.Php, includes/recentchanges/RecentChangeStore.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61640

Stored XSS through system messages in Special:RecentChangesLinked (MW Core)

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61645

CodexTablePager has i18n XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/pager/CodexTablePager.Php. This issue affects MediaWiki: from * before 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2024-34507

mediawiki: cross-site scripting

An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occur because of mishandling of the 0x1b character, as demonstrated by Special:RecentChanges#%1b0000000.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Mediawiki
Products
Fedora Mediawiki
CVE-2024-34506

mediawiki: denial of service

An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the necessary rights to move the page opens Special:MovePage for a page with tens of thousands of subpages, then the page will exceed the maximum request time, leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Mediawiki
Products
Fedora Mediawiki
CVE-2024-34502

mediawiki: MergeLexemes makes edits on GET requests without edit tokens

An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Mediawiki
Products
Fedora Mediawiki
CVE-2024-34500

mediawiki: XSS through interface message in UnlinkedWikibase

An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Mediawiki
Products
Fedora Mediawiki
CVE-2023-51704

mediawiki: group-.*-member messages are not properly escaped on Special:log/rights

An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2023-45362

mediawiki: diff-multi-sameuser ("X intermediate revisions by the same user not shown") ignores username suppression

An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. diff-multi-sameuser (aka "X intermediate revisions by the same user not shown") ignores username suppression. This is an information leak.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2023-45360

mediawiki: XSS in youhavenewmessagesmanyusers and youhavenewmessages i18n messages

An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is XSS in youhavenewmessagesmanyusers and youhavenewmessages i18n messages. This is related to MediaWiki:Youhavenewmessagesfromusers.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki
Products
Mediawiki
CVE-2025-59839

Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes

The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. In versions 4.0.0 and prior, the EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext. This issue has been patched via commit 4e075d3.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Mediawiki Star-citizen
Products
Mediawiki Embedvideo