Search for packages
| purl | pkg:deb/debian/mediawiki@0?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-27j6-j549-6fak | MediaWiki: MediaWiki: Cross-site Scripting via improper input neutralization |
CVE-2025-61637
|
| VCID-2sp5-hgmr-mkcc | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2022-41766
|
| VCID-35t3-tu86-nugv | Mediawiki tarball is missing .htaccess files Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible. |
CVE-2018-13258
GHSA-2c28-7gwv-cpgf |
| VCID-455k-fs8w-bkd3 | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-9476
|
| VCID-4r56-cjss-1kef | Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0. |
CVE-2025-6592
|
| VCID-5dcu-84tv-yyag | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2011-0537
|
| VCID-663c-7t89-pqbj | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578 and CVE-2011-1587. |
CVE-2011-1765
|
| VCID-7b4s-a2bu-xqee | MediaWiki: MediaWiki: Information disclosure vulnerability in ImportableOldRevisionImporter.Php |
CVE-2025-67476
|
| VCID-7cwp-qe76-afhp | MediaWiki: MediaWiki: Cross-site scripting vulnerability allows information disclosure via improper input neutralization |
CVE-2025-61645
|
| VCID-7e5e-s9xa-5bey | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-2244
|
| VCID-7kax-fqa1-kfbu | Vulnerability in Wikimedia Foundation DiscussionTools.This issue affects DiscussionTools: from * before 1.43.4, 1.44.1. |
CVE-2025-61652
|
| VCID-9kdx-3ufy-zybu | mediawiki: cross-site scripting |
CVE-2024-34507
|
| VCID-9mqn-n4pu-v7dj | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from * before > fb856ce9cf121e046305116852cca4899ecb48ca. |
CVE-2025-61644
|
| VCID-9qyu-z71g-1qbq | MediaWiki Open Redirect vulnerability resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.34.0-rc.0 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page. |
CVE-2020-10959
GHSA-mqhw-wq8p-vf5r |
| VCID-a11n-r5nu-pben | Vulnerability in Wikimedia Foundation Thanks. This vulnerability is associated with program files includes/ThanksQueryHelper.Php. This issue affects Thanks: from * before 1.43.4, 1.44.1. |
CVE-2025-61654
|
| VCID-a1vt-rm2f-bufa | Cross-site scripting vulnerability in includes/actions/InfoAction.php Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action. |
CVE-2014-2853
GHSA-6h86-9r5g-f2h5 |
| VCID-aggz-kyqz-fqcz | Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service. |
CVE-2013-1818
|
| VCID-anb7-mem4-bue9 |
CVE-2026-34090
|
|
| VCID-b2ha-594t-9qgw | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js. This issue affects Vector: from * before 1.43.4, 1.44.1. |
CVE-2025-61657
|
| VCID-bh5a-psbr-jfe6 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php. This issue affects MediaWiki: >= 1.42.0. |
CVE-2025-6589
|
| VCID-bqz1-vt2b-77c5 | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2012-1580
|
| VCID-buwp-69zb-93hs |
CVE-2026-5266
|
|
| VCID-c7bg-91ab-33b4 | An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestamp, both of which are not supposed to be public information. |
CVE-2023-45364
|
| VCID-cvrr-j6cm-zug4 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects Vector: from >= 1.40.0 before 1.42.7, 1.43.2, 1.44.0. |
CVE-2025-6596
|
| VCID-dmfu-qdq6-s7ee | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-9276
|
| VCID-ebyj-sw2v-pkce | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseLog.Php, includes/Pager/AbuseLogPager.Php, includes/Special/SpecialAbuseLog.Php, includes/View/AbuseFilterViewExamine.Php. This issue affects AbuseFilter: from >= 1.43.0 before 1.43.1. |
CVE-2025-32700
|
| VCID-eufd-erhj-bubj | Improper permissions handling in MediaWiki AbuseFilter An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter. |
CVE-2024-47913
GHSA-rmcp-9fhq-58pv |
| VCID-fax7-reqw-y3d2 | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2012-1579
|
| VCID-fywr-5dsx-j7bd | MediaWiki: MediaWiki: Information disclosure via block list handling |
CVE-2025-6927
|
| VCID-gad5-ezcv-37a2 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-61636
|
| VCID-gqck-rgm3-1bh2 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.9.x before 1.9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "sortable tables JavaScript." |
CVE-2007-0788
|
| VCID-gy47-pvfy-6qcp | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2012-1578
|
| VCID-h6tn-wafd-yfh5 | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2011-1766
|
| VCID-hjjw-pz2f-rqg2 | MediaWiki: MediaWiki: Cross-site Scripting (XSS) vulnerability via improper input neutralization |
CVE-2025-61642
|
| VCID-htw4-yeam-p3ca | mediawiki: Special: Contributions toolbar reveals existence of hidden users |
CVE-2021-30156
|
| VCID-k1su-kx23-bqgw | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-9507
|
| VCID-k919-9wbt-yke9 |
CVE-2026-34089
|
|
| VCID-m4su-a694-cbfk | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2010-2789
|
| VCID-n22t-95dq-p7hr | MediaWiki: MediaWiki: Cross-site scripting vulnerability in page preview functionality |
CVE-2025-67483
|
| VCID-pang-rr37-hkem | A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere&target=Property%3AP31&namespace=1&invert=1 can take more than thirty seconds. There is a DDoS risk. |
CVE-2022-28204
|
| VCID-pp1z-ybpu-xbby | An issue was discovered in VectorComponentUserLinks.php in the Vector Skin component in MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-intro-page MalformedTitleException is uncaught if it is not a valid title, leading to incorrect web pages. |
CVE-2023-45361
|
| VCID-q7k6-59z5-d7a7 |
CVE-2026-34094
|
|
| VCID-r5gb-8nuq-2yca | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-61634
|
| VCID-rn3q-78tk-w3am | An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup. |
CVE-2023-45359
|
| VCID-s9d6-rtuj-u3hy | MediaWiki: MediaWiki: Cross-site Scripting vulnerability |
CVE-2025-67477
|
| VCID-sbfx-kzg5-j3f5 | MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters. |
CVE-2015-8625
|
| VCID-td1x-eqxz-zyfx | Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a dynamic class name that is processed using the eval function. |
CVE-2005-4031
|
| VCID-vaaj-f4v8-qbhj | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundation Mediawiki - DiscussionTools Extension allows Regular Expression Exponential Blowup.This issue affects Mediawiki - DiscussionTools Extension: 1.44, 1.43. |
CVE-2025-11175
|
| VCID-wdhw-9jgd-8yb5 | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-5242
|
| VCID-ws1z-1mv2-f7d1 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.6.0 up to versions before 1.6.7 allows remote attackers to inject arbitrary HTML and web script via the edit form. |
CVE-2006-2895
|
| VCID-xdct-ca96-3uat |
CVE-2026-34091
|
|
| VCID-y9bq-v1bg-7keh | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-6729
|