Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 527

Export CSV
CVE-2025-61658

Special:GlobalContributions shows edits on wikis the viewer doesn't have access to

Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/GlobalContributions/GlobalContributionsPager.Php. This issue affects CheckUser: from * before 1.43.4, 1.44.1.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Checkuser Checkuser
CVE-2025-67476

Importing leaks IP address of importer via EventStreams

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

CVSS 4.0 · 1.3 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-67478

Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"

Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Checkuser Checkuser
CVE-2025-67480

list=allrevisions can be used to bypass Extension:Lockdown

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-67484

Action API xslt option allows JavaScript execution by administrators who are not interface administrators

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61648

Stored XSS through system messages in CheckUser

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/ShowIPButton.Vue, modules/ext.CheckUser.TempAccounts/SpecialBlock.Js. This issue affects CheckUser: from * before 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Checkuser Checkuser
CVE-2025-61651

i18n XSS through Special:CheckUser CheckUser helper

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser/checkuser/checkUserHelper/buildUserElement.Js. This issue affects CheckUser: from * before 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Checkuser Checkuser
CVE-2025-61655

Stored XSS through system messages in VisualEditor

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.Js, modules/ve-mw/ui/dialogs/ve.Ui.MWSaveDialog.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Visual Editor Visualeditor
CVE-2025-61656

XSS when pasting into VE

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Visual Editor Visualeditor
CVE-2025-67475

Stored XSS through edit summaries in MW Core

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-67477

Stored XSS through a system message in Special:ApiSandbox

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-67481

mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-67483

Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61641

API list=allpages with maxsize is making really slow queries

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 1.7 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61642

Stored XSS through system messages provided to CodexHtmlForms

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/CodexHTMLForm.Php, includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61643

EventStreams publishes suppressed recent change entries that are suppressed from their creation

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-11261

Stored i18n XSS exposed by security patch for T402077

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61646

Watchlist group mode reveals authors of edits with hidden authorship

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 1.2 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61634

HTML rest endpoint needs PoolCounter and proper parser cache check

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki
CVE-2025-61636

Codex Special:Block vulnerable to message key XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

CVSS 4.0 · 0 Low EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Mediawiki Mediawiki