Search for packages
| purl | pkg:deb/debian/mediawiki@1:1.43.8%2Bdfsg-2?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-1697-p35n-fber | Wikimedia MediaWiki allows CSRF Wikimedia MediaWiki through 1.32.1 allows CSRF in logout feature. |
CVE-2019-12466
GHSA-27fw-r78j-h898 |
| VCID-17bk-y8nb-kfc9 | security update |
CVE-2013-6454
|
| VCID-1866-gt2g-1qfv | MediaWiki Incorrect Access Control vulnerability MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12469
GHSA-x3fr-w7r5-x7rg |
| VCID-1993-aw6b-4kg7 | security update |
CVE-2017-8808
|
| VCID-1bkk-tvsa-ukb1 | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2934
|
| VCID-1f7s-dk69-mqg2 | The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via the "Change block" text. |
CVE-2015-6727
|
| VCID-1fr2-q23d-ekdf | mediawiki: remote information disclosure |
CVE-2017-0371
|
| VCID-1hwd-avxk-fqbs | The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics. |
CVE-2015-8628
|
| VCID-1na8-nyq1-yfcy | An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword. |
CVE-2021-20270
GHSA-9w8r-397f-prfh PYSEC-2021-140 |
| VCID-1ner-ujf7-yfav | Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.5 allow remote attackers to execute arbitrary scripts and/or SQL queries via (1) the UnicodeConverter extension, (2) raw page views, (3) SpecialIpblocklist, (4) SpecialEmailuser, (5) SpecialMaintenance, and (6) ImagePage. |
CVE-2004-2185
|
| VCID-1umc-vf94-87e6 | security update |
CVE-2013-6472
|
| VCID-22yj-98wv-skc9 | security update |
CVE-2017-8815
|
| VCID-27j6-j549-6fak | MediaWiki: MediaWiki: Cross-site Scripting via improper input neutralization |
CVE-2025-61637
|
| VCID-29fv-52ge-mbft | mediawiki: "Mark all pages visited" on the watchlist does not require a CSRF token |
CVE-2017-0362
|
| VCID-2abz-k2yv-zkbp | security update |
CVE-2017-8809
|
| VCID-2fva-bc2j-dban | MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via multiple file uploads. |
CVE-2015-8003
|
| VCID-2s26-v16e-6uds | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-2242
|
| VCID-2sp5-hgmr-mkcc | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2022-41766
|
| VCID-2wcb-hty6-uyez | Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43. |
CVE-2025-32072
|
| VCID-2xa5-1rmz-bfh3 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578. |
CVE-2011-1587
|
| VCID-2xja-2whv-fqe4 | mediawiki: diff-multi-sameuser ("X intermediate revisions by the same user not shown") ignores username suppression |
CVE-2023-45362
|
| VCID-2yav-jgcc-zyhc | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2011-1579
|
| VCID-3181-j1se-eqgt | security update |
CVE-2013-4572
|
| VCID-32f4-khen-3yez | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in a Denial of Service condition. |
CVE-2021-30159
|
| VCID-35t3-tu86-nugv | Mediawiki tarball is missing .htaccess files Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible. |
CVE-2018-13258
GHSA-2c28-7gwv-cpgf |
| VCID-3mg7-t5t5-akac | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.x before 1.4.6 and 1.5 before 1.5beta3 allows remote attackers to inject arbitrary web script or HTML via a parameter in the page move template, a different vulnerability than CVE-2005-1888. |
CVE-2005-2215
|
| VCID-3s9f-prpy-hbcx | Cross-site Scripting The jQuery library, which is included in rdoc, mishandles `jQuery.extend(true, {}, ...)` because of Object.prototype pollution. If an unsanitized source object contained an enumerable `__proto__` property, it could extend the native `Object.prototype.` |
CVE-2019-11358
GHSA-6c3j-c64m-qhgq |
| VCID-3yt6-jnfb-9fcw | MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed. |
CVE-2015-8627
|
| VCID-3zue-5ccg-23hs | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1. |
CVE-2025-67480
|
| VCID-41dt-sag4-tbc8 | MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter. |
CVE-2011-4360
|
| VCID-424y-cjxg-c7az | MediaWiki Cross-site Scripting (XSS) vulnerability An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely using message text to build options names for an HTML multi-select field. The relevant code should use escaped() instead of text(). |
CVE-2020-25815
GHSA-2f58-vf6g-6p8x |
| VCID-455k-fs8w-bkd3 | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-9476
|
| VCID-484p-b45x-nqcd | Cross-site scripting (XSS) vulnerability in MediaWiki 1.4.6 and earlier allows remote attackers to inject arbitrary web script or HTML via a parameter to the page move template. |
CVE-2005-2396
|
| VCID-4dfp-3qk9-j7fg | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in a Denial of Service condition. |
CVE-2021-35197
|
| VCID-4hp5-bdkg-fufh | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2936
|
| VCID-4keq-jcfa-13hc | Possible to circumvent title-blacklist MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page. |
CVE-2019-19709
GHSA-pjv5-vv93-p648 |
| VCID-4r56-cjss-1kef | Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0. |
CVE-2025-6592
|
| VCID-4vc8-5xct-wke5 | Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service. |
CVE-2013-4301
|
| VCID-4yhr-jjt9-afaq | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-61641
|
| VCID-542a-pavw-b7ax | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2932
|
| VCID-5dcu-84tv-yyag | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2011-0537
|
| VCID-5fsv-cduw-ybb8 | MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the installation path by reading the metadata of a PNG thumbnail file. |
CVE-2015-8005
|
| VCID-5muy-wgqw-dffa | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked. |
CVE-2016-6332
|
| VCID-5myd-ngfx-5qhb | mediawiki: group-.*-member messages are not properly escaped on Special:log/rights |
CVE-2023-51704
|
| VCID-5ye5-j6zz-bkau | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.3, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. |
CVE-2011-1578
|
| VCID-663c-7t89-pqbj | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.5, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .shtml at the end of the query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578 and CVE-2011-1587. |
CVE-2011-1765
|
| VCID-674z-nf4t-b7ez | Cross-domain cookie leakage in Guzzle ### Impact Previous version of Guzzle contain a vulnerability with the cookie middleware. The vulnerability is that it is not checked if the cookie domain equals the domain of the server which sets the cookie via the `Set-Cookie` header, allowing a malicious server to set cookies for unrelated domains. For example an attacker at `www.example.com` might set a session cookie for `api.example.net`, logging the Guzzle client into their account and retrieving private API requests from the security log of their account. Note that our cookie middleware is disabled by default, so most library consumers will not be affected by this issue. Only those who manually add the cookie middleware to the handler stack or construct the client with `['cookies' => true]` are affected. Moreover, those who do not use the same Guzzle client to call multiple domains and have disabled redirect forwarding are not affected by this vulnerability. ### Patches Affected Guzzle 7 users should upgrade to Guzzle 7.4.3 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.6 or 7.4.3. ### Workarounds If you do not need support for cookies, turn off the cookie middleware. It is already off by default, but if you have turned it on and no longer need it, turn it off. ### References * [RFC6265 Section 5.3](https://datatracker.ietf.org/doc/html/rfc6265#section-5.3) * [RFC9110 Section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx) ### For more information If you have any questions or comments about this advisory, please get in touch with us in `#guzzle` on the [PHP HTTP Slack](https://php-http.slack.com/). Do not report additional security advisories in that public channel, however - please follow our [vulnerability reporting process](https://github.com/guzzle/guzzle/security/policy). |
CVE-2022-29248
GHSA-cwmx-hcrq-mhc3 |
| VCID-6ads-gs3n-dubh | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in a Denial of Service condition. |
CVE-2021-30458
GHSA-5pqx-77vf-85rw |
| VCID-6gjh-cn8c-3yfp | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-9277
|
| VCID-6jq2-8mv5-pqaa | security update |
CVE-2017-8811
|
| VCID-6nqq-qzjq-bkc8 | Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page. |
CVE-2012-2698
|
| VCID-73p6-esc6-tydd | mediawiki: potential XSS via MediaWiki:blanknamespace outputting Block Logs |
CVE-2020-35478
|
| VCID-74ej-8sna-jyek | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/LogPager.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1. |
CVE-2025-32698
|
| VCID-7831-8u7z-6fep | Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/IntroMessageBuilder.Php, includes/Permissions/PermissionManager.Php, includes/Permissions/RestrictionStore.Php. This issue affects MediaWiki: before 1.42.6, 1.43.1. |
CVE-2025-32697
|
| VCID-7ar6-14bb-yfc5 | mediawiki: divergent behavior for contributions and user pages of hidden users and missing users |
CVE-2020-35480
|
| VCID-7b4s-a2bu-xqee | MediaWiki: MediaWiki: Information disclosure vulnerability in ImportableOldRevisionImporter.Php |
CVE-2025-67476
|
| VCID-7cwp-qe76-afhp | MediaWiki: MediaWiki: Cross-site scripting vulnerability allows information disclosure via improper input neutralization |
CVE-2025-61645
|
| VCID-7e5e-s9xa-5bey | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-2244
|
| VCID-7eba-7gsc-hbfg | X-Forwarded-For header allows brute-forcing autoblocked IP addresses An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-Forwarded-For header. |
CVE-2023-29141
GHSA-5vj8-g3qg-4qh6 |
| VCID-7j54-uz1w-y3dn | security update |
CVE-2021-41801
|
| VCID-7kax-fqa1-kfbu | Vulnerability in Wikimedia Foundation DiscussionTools.This issue affects DiscussionTools: from * before 1.43.4, 1.44.1. |
CVE-2025-61652
|
| VCID-7m3q-wuh7-k7fn | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in a Denial of Service condition. |
CVE-2021-30154
|
| VCID-7ncu-yjpc-puf6 | The wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to cause a denial of service (infinite loop) via certain input, as demonstrated by the padleft function. |
CVE-2012-4885
|
| VCID-7r33-m2f3-dkbm | Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service. |
CVE-2013-2031
|
| VCID-7sm8-2ced-6ba8 | mediawiki allows deleted text to be exposed |
CVE-2012-0046
|
| VCID-7vxy-rrmp-8ffr | Incomplete blacklist vulnerability in MediaWiki before 1.4.11 does not properly remove certain CSS inputs (HTML inline style attributes) that are processed as active content by Internet Explorer, which allows remote attackers to conduct cross-site scripting (XSS) attacks. |
CVE-2005-3167
|
| VCID-7wh4-say2-pqap | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-61656
|
| VCID-812q-n5hg-u7dx | mediawiki: message recentchanges-legend-watchlistexpiry can contain raw html |
CVE-2020-35474
|
| VCID-89jn-9da6-d7dr | Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers to cause a denial of service (infinite loop) via "certain malformed links." |
CVE-2006-0322
|
| VCID-8eu3-c31a-tbhk | MediaWiki is vulnerable to a cross-site scripting attack that could allow arbitrary JavaScript code execution. |
CVE-2006-1498
|
| VCID-8sqw-6aae-13f5 | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in a Denial of Service condition. |
CVE-2021-30157
|
| VCID-8svz-zhz1-vyh6 | ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php. |
CVE-2016-6331
|
| VCID-8sym-py6e-fkf2 | security update |
CVE-2014-5241
|
| VCID-8u2s-64jg-v3gc | security update |
CVE-2013-4568
|
| VCID-8uw8-ja3w-r3da | MediaWiki: MediaWiki: Cross-site Scripting (XSS) vulnerability |
CVE-2025-11261
|
| VCID-92hf-r3sb-jbhy | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2021-44855
|
| VCID-9346-9aaj-fkfw | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2022-41765
|
| VCID-95d1-mkm6-r3cq | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0. |
CVE-2025-6591
|
| VCID-9e5y-vgvx-73d6 | Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities. |
CVE-2017-0372
|
| VCID-9exs-x5s1-4bhg | Failure to strip the Cookie header on change in host or HTTP downgrade ### Impact `Cookie` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, or on making a request to a server which responds with a redirect to a a URI to a different host, we should not forward the `Cookie` header on. Prior to this fix, only cookies that were managed by our cookie middleware would be safely removed, and any `Cookie` header manually added to the initial request would not be stripped. We now always strip it, and allow the cookie middleware to re-add any cookies that it deems should be there. ### Patches Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. ### Workarounds An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together. ### References * [RFC9110 Section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx) ### For more information If you have any questions or comments about this advisory, please get in touch with us in `#guzzle` on the [PHP HTTP Slack](https://php-http.slack.com/). Do not report additional security advisories in that public channel, however - please follow our [vulnerability reporting process](https://github.com/guzzle/guzzle/security/policy). |
CVE-2022-31042
GHSA-f2wf-25xc-69c9 |
| VCID-9fzf-gj7f-6ken | security update |
CVE-2013-6452
|
| VCID-9g1g-z7d8-c7ah | Regular Expression Denial of Service in papaparse Versions of `papaparse` prior to 5.2.0 are vulnerable to Regular Expression Denial of Service (ReDos). The `parse` function contains a malformed regular expression that takes exponentially longer to process non-numerical inputs. This allows attackers to stall systems and lead to Denial of Service. ## Recommendation Upgrade to version 5.2.0 or later. |
CVE-2020-36649
GHSA-qvjc-g5vr-mfgr GMS-2020-421 |
| VCID-9kdx-3ufy-zybu | mediawiki: cross-site scripting |
CVE-2024-34507
|
| VCID-9mqn-n4pu-v7dj | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from * before > fb856ce9cf121e046305116852cca4899ecb48ca. |
CVE-2025-61644
|
| VCID-9nnu-4mda-7qg9 | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2021-41798
|
| VCID-9qyu-z71g-1qbq | MediaWiki Open Redirect vulnerability resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.34.0-rc.0 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page. |
CVE-2020-10959
GHSA-mqhw-wq8p-vf5r |
| VCID-9xem-j55b-cbad | Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors. |
CVE-2004-2187
|
| VCID-9xyz-wzr8-wqhz | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2022-31090
GHSA-25mq-v84q-4j7r GMS-2022-2528 |
| VCID-a11n-r5nu-pben | Vulnerability in Wikimedia Foundation Thanks. This vulnerability is associated with program files includes/ThanksQueryHelper.Php. This issue affects Thanks: from * before 1.43.4, 1.44.1. |
CVE-2025-61654
|
| VCID-a1vt-rm2f-bufa | Cross-site scripting vulnerability in includes/actions/InfoAction.php Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action. |
CVE-2014-2853
GHSA-6h86-9r5g-f2h5 |
| VCID-a8nh-mvhd-bka7 | MediaWiki: MediaWiki: Vulnerability in authentication management |
CVE-2025-6597
|
| VCID-ad34-frk5-kqds | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in a Denial of Service condition. |
CVE-2021-30158
|
| VCID-aeju-gazv-abfz | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2935
|
| VCID-aggz-kyqz-fqcz | Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service. |
CVE-2013-1818
|
| VCID-ahev-x89y-9fdp | Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.9.x before 1.9.0rc2, and 1.8.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the rs parameter. NOTE: this issue might be a duplicate of CVE-2007-0177. |
CVE-2007-1055
|
| VCID-ammy-qfbj-sfdu | Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service. |
CVE-2013-1817
|
| VCID-anb7-mem4-bue9 |
CVE-2026-34090
|
|
| VCID-arzd-7xhw-qqb4 | OATHAuth extension in MediaWiki is not implementing rate limit An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently. |
CVE-2020-25827
GHSA-rqvj-fc2x-99q6 |
| VCID-at9r-vw7p-6bfv | MediaWiki makeCollapsible allows applying event handler to any CSS selector In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS). |
CVE-2020-10960
GHSA-pfm2-mqwj-ggm5 |
| VCID-av7r-cpew-xkcn | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2021-45038
|
| VCID-azup-qzq7-sbh6 | MediaWiki Cross-site Scripting (XSS) vulnerability In MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> tag (or it does not have a href attribute, or it's empty, etc.). The actual result is that the object contains an <a href ="javascript... that executes when clicked. |
CVE-2020-25814
GHSA-4vr7-m8p8-434h |
| VCID-b2ha-594t-9qgw | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js. This issue affects Vector: from * before 1.43.4, 1.44.1. |
CVE-2025-61657
|
| VCID-b31c-cuwj-pqcm | security update |
CVE-2014-5243
|
| VCID-b5ke-cjtq-q3ev | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MultimediaViewer.This issue affects MultimediaViewer: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0. |
CVE-2025-6595
|
| VCID-b8r6-r39r-3ffm | MediaWiki: Manualthumb bypasses badFile lookup |
CVE-2023-36674
|
| VCID-b9ku-hpp1-zkd2 | Cross-site scripting (XSS) vulnerability in 'raw' page output mode for MediaWiki 1.3.4 and earlier allows remote attackers to inject arbitrary web script or HTML. |
CVE-2004-2152
|
| VCID-bbef-akjp-a3gp | Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12473
GHSA-33xw-x3pr-rvqj |
| VCID-bg3q-tt6z-2ycw | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2010-2787
|
| VCID-bgjt-nzue-bqc1 | Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links. |
CVE-2016-6334
|
| VCID-bh5a-psbr-jfe6 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php. This issue affects MediaWiki: >= 1.42.0. |
CVE-2025-6589
|
| VCID-bncm-yfp5-1fdg | Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service. |
CVE-2013-1951
|
| VCID-bqz1-vt2b-77c5 | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2012-1580
|
| VCID-brg4-rv29-1fgz | In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service. |
CVE-2021-27291
GHSA-pq64-v7f5-gqh8 PYSEC-2021-141 |
| VCID-bst2-2v56-a3h9 | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-2243
|
| VCID-buwp-69zb-93hs |
CVE-2026-5266
|
|
| VCID-bwnb-xxrw-9khf | Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service. |
CVE-2013-4303
|
| VCID-c7bg-91ab-33b4 | An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is leaked due to incorrect permissions being checked. This reveals that a given revision ID belonged to the given page title, and its timestamp, both of which are not supposed to be public information. |
CVE-2023-45364
|
| VCID-c8zy-wsn9-63af | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2021-41799
|
| VCID-cbtm-g4t5-u3am |
CVE-2026-34093
|
|
| VCID-ckkj-z5nq-akhb | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2021-44857
|
| VCID-cm78-savr-xuf7 | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-6730
|
| VCID-cvrr-j6cm-zug4 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects Vector: from >= 1.40.0 before 1.42.7, 1.43.2, 1.44.0. |
CVE-2025-6596
|
| VCID-cww2-7sas-ufbw | MediaWiki 1.8.1, and other versions before 1.13.3, when the wgShowExceptionDetails variable is enabled, sometimes provides the full installation path in a debugging message, which might allow remote attackers to obtain sensitive information via unspecified requests that trigger an uncaught exception. |
CVE-2008-5688
|
| VCID-d2d1-77g2-9kac | security update |
CVE-2014-7199
|
| VCID-d5vz-puw9-t7er |
CVE-2026-34088
|
|
| VCID-d6kz-e82q-6kh3 | mediawiki: potential XSS via the month messages such as MediaWiki:january through MediaWiki:december outputting Block Logs |
CVE-2020-35479
|
| VCID-dbed-h6a2-fucf | security update |
CVE-2017-8814
|
| VCID-den1-257q-euc9 | Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associated with program files includes/ApiQueryExtracts.Php. This issue affects TextExtracts: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-61653
|
| VCID-dgmf-63vf-gkhp | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2937
|
| VCID-dmfu-qdq6-s7ee | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-9276
|
| VCID-e2td-jqbd-vbaa | The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623. |
CVE-2015-8624
|
| VCID-e3ad-yw1a-nbbu | mediawiki: Make rawHTML mode not apply to system messages |
CVE-2017-0368
|
| VCID-e4uj-5hwm-t7a9 | Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.4.9 allow remote attackers to inject arbitrary web script or HTML via (1) <math> tags or (2) Extension or <nowiki> sections that "bypass HTML style attribute restrictions" that are intended to protect against XSS vulnerabilities in Internet Explorer clients. |
CVE-2005-3165
|
| VCID-e8np-4nbw-t3b3 | Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated with program files src/Special/OATHManage.Php. This issue affects OATHAuth: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-11173
|
| VCID-e9pq-ynp8-nygx | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason via a reblock attempt. |
CVE-2012-4382
|
| VCID-ea7c-xk4h-13fs | mediawiki: stored XSS leads to privilege escalation |
CVE-2023-3550
|
| VCID-ebyj-sw2v-pkce | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseLog.Php, includes/Pager/AbuseLogPager.Php, includes/Special/SpecialAbuseLog.Php, includes/View/AbuseFilterViewExamine.Php. This issue affects AbuseFilter: from >= 1.43.0 before 1.43.1. |
CVE-2025-32700
|
| VCID-edpm-d35f-qfch | MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions. |
CVE-2011-4361
|
| VCID-eefm-65rj-pyg2 | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2021-44858
|
| VCID-eskt-ytr3-cfhh | MediaWiki before 1.5.4 uses a hard-coded "internal placeholder string", which allows remote attackers to bypass protection against cross-site scripting (XSS) attacks and execute Javascript using inline style attributes, which are processed by Internet Explorer. |
CVE-2005-4501
|
| VCID-eufd-erhj-bubj | Improper permissions handling in MediaWiki AbuseFilter An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter. |
CVE-2024-47913
GHSA-rmcp-9fhq-58pv |
| VCID-fax7-reqw-y3d2 | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2012-1579
|
| VCID-fkvy-961u-37be | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2940
|
| VCID-fm5x-32wy-57e3 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header, which allows remote attackers to conduct clickjacking attacks via an embedded API response in an IFRAME element. |
CVE-2012-4379
|
| VCID-fnzm-dxb3-v7hr | An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. (It shouldn't because they are hidden.) This is related to ApiVisualEditor. |
CVE-2021-30153
|
| VCID-fpkf-8mcr-6bee | MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights. |
CVE-2016-6337
|
| VCID-fptt-2t1j-8fec | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/ManualLogEntry.Php, includes/recentchanges/RecentChangeFactory.Php, includes/recentchanges/RecentChangeStore.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-61639
|
| VCID-fsk6-nkuk-wqa3 | Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php. |
CVE-2012-4378
|
| VCID-fujm-vb7d-vfhe | The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk consumption) via a file upload using one byte chunks. |
CVE-2015-8002
|
| VCID-fwb3-kxy8-73hz | mediawiki: unable to change visibility of log entries when MediaWiki:Mainpage uses Special:MyLanguage |
CVE-2020-35477
|
| VCID-fywr-5dsx-j7bd | MediaWiki: MediaWiki: Information disclosure via block list handling |
CVE-2025-6927
|
| VCID-g2h7-8fye-wqcz | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2012-1582
|
| VCID-g46d-hscr-u7cj | Unspecified vulnerability in MediaWiki 1.11 before 1.11.2 allows remote attackers to obtain sensitive "cross-site" information via the callback parameter in an API call for JavaScript Object Notation (JSON) formatted results. |
CVE-2008-1318
|
| VCID-g5sv-bc5q-1kga | Cross-site scripting (XSS) vulnerability in the AJAX features in index.php in MediaWiki 1.6.x through 1.9.2, when $wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via a UTF-7 encoded value of the rs parameter, which is processed by Internet Explorer. |
CVE-2007-1054
|
| VCID-gad5-ezcv-37a2 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-61636
|
| VCID-gcrr-6tnm-pyar | Directory traversal vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to delete arbitrary files or determine file existence via a parameter related to image deletion. |
CVE-2005-0536
|
| VCID-gefx-bbtq-xyhj | Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service. |
CVE-2013-2032
|
| VCID-gma6-b9cy-kqee | MediaWiki Incorrect Access Control vulnerability MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12467
GHSA-6vfg-8ppv-h5hg |
| VCID-gq2p-qjcs-rbaf | Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the session_id. |
CVE-2012-5391
|
| VCID-gqck-rgm3-1bh2 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.9.x before 1.9.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "sortable tables JavaScript." |
CVE-2007-0788
|
| VCID-gy47-pvfy-6qcp | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2012-1578
|
| VCID-h3d2-nr9e-nqbk | Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2. |
CVE-2025-6926
|
| VCID-h5xs-ky4t-b7ad | Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css. |
CVE-2016-6333
|
| VCID-h6k9-uykg-pqhx | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2011-0003
|
| VCID-h6tn-wafd-yfh5 | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2011-1766
|
| VCID-h789-pcxv-kbgd | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLUserTextField.Php. This issue affects MediaWiki: from * through 1.39.12, 1.42.76 1.43.1, 1.44.0. |
CVE-2025-6590
|
| VCID-h8jw-brz8-hkfn | MediaWiki Cross-site Scripting (XSS) vulnerability An issue was discovered in MediaWiki 1.34.x before 1.34.3. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML. |
CVE-2020-25812
GHSA-rj9p-8jxj-2ch4 |
| VCID-hjjw-pz2f-rqg2 | MediaWiki: MediaWiki: Cross-site Scripting (XSS) vulnerability via improper input neutralization |
CVE-2025-61642
|
| VCID-hrye-skfn-zbdx | Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service. |
CVE-2013-4302
|
| VCID-ht8a-qas7-4kce | security update |
CVE-2013-6453
|
| VCID-htw4-yeam-p3ca | mediawiki: Special: Contributions toolbar reveals existence of hidden users |
CVE-2021-30156
|
| VCID-hzhn-4f3y-vyhs | security update |
CVE-2014-1610
|
| VCID-j1bz-4bex-4key | mediawiki: messages userrights-expiry-current and userrights-expiry-none can contain raw html |
CVE-2020-35475
|
| VCID-ja6g-fvjy-77ck | security update |
CVE-2014-3966
|
| VCID-jm7q-2w3j-buhh | MediaWiki Denial of Service vulnerability An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set. |
CVE-2023-45363
GHSA-w5fx-cx7f-6vr9 |
| VCID-jndf-ke83-tug8 | mediawiki: multiple XSS issues in the installer |
CVE-2009-0737
|
| VCID-jwkd-wdus-6ygg | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2022-47927
|
| VCID-k1f5-msra-4kam | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in a Denial of Service condition. |
CVE-2021-30155
|
| VCID-k1su-kx23-bqgw | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-9507
|
| VCID-k6ry-6a7f-eqd7 | mediawiki: Improper URL sanitization in Spam blacklist |
CVE-2017-0370
|
| VCID-k7qb-7hbj-1qc2 | MediaWiki: MediaWiki: Cross-site Scripting vulnerability via improper input neutralization |
CVE-2025-6594
|
| VCID-k919-9wbt-yke9 |
CVE-2026-34089
|
|
| VCID-khgd-tw9d-jucz | Cross-site scripting (XSS) vulnerability in the API pretty-printing mode in MediaWiki 1.8.0 through 1.8.4, 1.9.0 through 1.9.3, 1.10.0 through 1.10.1, and the 1.11 development versions before 1.11.0 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2007-4828
|
| VCID-kjp3-cs2f-t7b4 | MediaWiki Cross-site Scripting (XSS) Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12471
GHSA-2rm7-xxx8-35jh |
| VCID-kw32-af5a-hqg8 |
CVE-2026-34095
|
|
| VCID-kz44-vtd4-kbc5 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.2, when using HTML Tidy ($wgUseTidy), allows remote attackers to inject arbitrary web script or HTML via unknown vectors. |
CVE-2005-1245
|
| VCID-m1j5-3ecf-dffj | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2022-28202
|
| VCID-m1xy-yucr-dqfs | Vulnerability in Wikimedia Foundation ConfirmEdit. This vulnerability is associated with program files includes/FancyCaptcha/ApiFancyCaptchaReload.Php. This issue affects ConfirmEdit: *. |
CVE-2025-61635
|
| VCID-m4su-a694-cbfk | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2010-2789
|
| VCID-m5a4-k87e-skaq | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image. |
CVE-2012-4377
|
| VCID-m7uw-sa5j-u3bw | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1. |
CVE-2025-67481
|
| VCID-mbs4-gs37-1fh5 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-61646
|
| VCID-mzd9-bu4b-wfar | The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text. |
CVE-2013-7444
|
| VCID-n22t-95dq-p7hr | MediaWiki: MediaWiki: Cross-site scripting vulnerability in page preview functionality |
CVE-2025-67483
|
| VCID-n6vz-mhwt-97g1 | Cross-site request forgery (CSRF) vulnerability in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allows remote attackers to perform unauthorized actions as authenticated MediaWiki users. |
CVE-2005-0535
|
| VCID-nqg1-1fyx-ruf9 | mediawiki: redirects to any interwiki link in special search |
CVE-2017-0364
|
| VCID-nre7-4fpc-9keb | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete. |
CVE-2016-6336
|
| VCID-nsd6-kt5p-w7fe | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to a page named "javascript:alert('XSS!')." |
CVE-2015-8622
|
| VCID-nwsr-ruca-2kha | Fix failure to strip Authorization header on HTTP downgrade ### Impact `Authorization` headers on requests are sensitive information. On making a request using the `https` scheme to a server which responds with a redirect to a URI with the `http` scheme, we should not forward the `Authorization` header on. This is much the same as to how we don't forward on the header if the host changes. Prior to this fix, `https` to `http` downgrades did not result in the `Authorization` header being removed, only changes to the host. ### Patches Affected Guzzle 7 users should upgrade to Guzzle 7.4.4 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.7 or 7.4.4. ### Workarounds An alternative approach would be to use your own redirect middleware, rather than ours, if you are unable to upgrade. If you do not require or expect redirects to be followed, one should simply disable redirects all together. ### References * [RFC9110 Section 15.4](https://www.rfc-editor.org/rfc/rfc9110.html#name-redirection-3xx) ### For more information If you have any questions or comments about this advisory, please get in touch with us in `#guzzle` on the [PHP HTTP Slack](https://php-http.slack.com/). Do not report additional security advisories in that public channel, however - please follow our [vulnerability reporting process](https://github.com/guzzle/guzzle/security/policy). |
CVE-2022-31043
GHSA-w248-ffj2-4v5q |
| VCID-p4xx-4b17-4ka6 | security update |
CVE-2014-2665
|
| VCID-p5r3-bpn6-17df | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.5 allows remote attackers to inject arbitrary web script via HTML attributes in page templates. |
CVE-2005-1888
|
| VCID-pang-rr37-hkem | A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere&target=Property%3AP31&namespace=1&invert=1 can take more than thirty seconds. There is a DDoS risk. |
CVE-2022-28204
|
| VCID-peaj-crkx-yfgz | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2933
|
| VCID-pm3s-z5ap-qqay | MediaWiki: MediaWiki: Arbitrary code execution via Cross-site Scripting (XSS) |
CVE-2025-61640
|
| VCID-pm5t-23j4-6yh6 | MediaWiki Cross-site Scripting (XSS) vulnerability An issue was discovered in MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.) |
CVE-2020-25828
GHSA-h8qx-mj6v-2934 |
| VCID-pp1z-ybpu-xbby | An issue was discovered in VectorComponentUserLinks.php in the Vector Skin component in MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-intro-page MalformedTitleException is uncaught if it is not a valid title, leading to incorrect web pages. |
CVE-2023-45361
|
| VCID-pqtu-ce8a-q7bk | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext passwords via a brute-force attack or, (2) when an authentication plugin returns a false in the strict function, could allow remote attackers to use old passwords for non-existing accounts in an external authentication system via unspecified vectors. |
CVE-2012-4381
|
| VCID-pw9d-1cwb-tyb9 | security update |
CVE-2022-28201
|
| VCID-pwjk-pzpj-aff6 | Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.16.5, 0.19.2, 0.20.2. |
CVE-2025-32699
|
| VCID-q1sz-4wvv-9kc5 | Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service. |
CVE-2013-1816
|
| VCID-q7k6-59z5-d7a7 |
CVE-2026-34094
|
|
| VCID-qgzv-a881-9khq | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2939
|
| VCID-qjhk-97j6-2qfm | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2021-44854
|
| VCID-qme5-cvje-1fg4 | MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the viewsuppressed user right to remove revision suppressions via a crafted revisiondelete action, which returns a valid a change form. |
CVE-2015-8004
|
| VCID-qmtg-trvt-kbe3 | MediaWiki 1.3.8 and earlier, when used with Apache mod_mime, does not properly handle files with two file extensions, such as .php.rar, which allows remote attackers to upload and execute arbitrary code. |
CVE-2004-1405
|
| VCID-qmx3-kcnd-zuhe | Wikimedia MediaWiki Incorrect Access Control vulnerability An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover. |
CVE-2019-12468
GHSA-wrhx-3pxr-6vgg |
| VCID-qpgu-mg6m-vyef | Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommon/lualib/mwInit.Lua, library.C. This issue affects Scribunto: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1; luasandbox: from * before fea2304f8f6ab30314369a612f4f5b165e68e95a. |
CVE-2025-67482
|
| VCID-qqvd-cjs3-7kab | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2022-34912
|
| VCID-qwcp-5hh8-z3gp | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2022-41767
|
| VCID-r4d2-1pxc-cqfh | Multiple MediaWiki XSS vulnerabilities |
CVE-2008-0460
|
| VCID-r5gb-8nuq-2yca | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-61634
|
| VCID-rd7h-vb4p-v3c3 | v.1.15.3: Login CSRF |
CVE-2010-1150
|
| VCID-rhq2-r3hq-tqc5 | The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which allows remote authenticated users to cause a denial of service via a chunk that exceeds the file size. |
CVE-2015-8001
|
| VCID-rjz9-twh9-wkaa | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors. |
CVE-2012-4380
|
| VCID-rn3q-78tk-w3am | An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup. |
CVE-2023-45359
|
| VCID-ruur-4cvx-cqct | mediawiki: cross site scripting |
CVE-2023-36675
|
| VCID-rwtk-hep1-xfaw | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in a Denial of Service condition. |
CVE-2021-30152
|
| VCID-rz65-w7x5-57hu | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2022-34911
|
| VCID-s5j8-5sjt-cfeu | security update |
CVE-2014-7295
|
| VCID-s9d6-rtuj-u3hy | MediaWiki: MediaWiki: Cross-site Scripting vulnerability |
CVE-2025-67477
|
| VCID-sbfx-kzg5-j3f5 | MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters. |
CVE-2015-8625
|
| VCID-sbq7-1cwg-bkhg | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2931
|
| VCID-sc5s-s7vg-dygq | mediawiki: denial of service |
CVE-2024-34506
|
| VCID-sca5-n7rz-rffq | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2021-44856
|
| VCID-sf61-byhw-17gv | Mediawiki Improper Privilege Management Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie'. |
CVE-2018-0503
GHSA-mhfv-9h99-jwg7 |
| VCID-sfp5-ygxn-nufe | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2942
|
| VCID-sh6q-pur2-gkag | mediawiki: SVG filter evasion using default attribute values in DTD declaration |
CVE-2017-0366
|
| VCID-sr9a-a6vt-1qgt | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Parsoid: from * before 0.16.6, 0.20.4, 0.21.1. |
CVE-2025-61638
|
| VCID-sz6n-4pbk-d7ay | mediawiki: information disclosure in the api.log |
CVE-2017-0361
|
| VCID-t6w8-cgct-gbgz | MediaWiki information disclosure In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup. |
CVE-2019-16738
GHSA-7hwr-f745-5rwq |
| VCID-td1x-eqxz-zyfx | Eval injection vulnerability in MediaWiki 1.5.x before 1.5.3 allows remote attackers to execute arbitrary PHP code via the "user language option," which is used as part of a dynamic class name that is processed using the eval function. |
CVE-2005-4031
|
| VCID-tewa-wqk4-5bhy | MediaWiki: Two security fixes in v1.15.2 |
CVE-2010-1189
|
| VCID-tkmz-uep2-4uev | SQL injection vulnerability in MediaWiki 1.3.5 allows remote attackers to execute arbitrary SQL commands via SpecialMaintenance. |
CVE-2004-2186
|
| VCID-tq2e-c9ym-a3hj | Wikimedia information leak vulnerability Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cached publicly. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12474
GHSA-2qrr-c2gh-pr35 |
| VCID-tutk-y8jg-n7dh | Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-67478
|
| VCID-u2xc-ztge-p3bv | MediaWiki Incorrect Access Control vulnerability An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12472
GHSA-7mqg-5fgh-xh4r |
| VCID-ubbe-qu8g-5fa1 | mediawiki: unsafe use of temporary directory |
CVE-2017-0367
|
| VCID-ujdn-y48t-pbch | MediaWiki Special:UserRights exposes the existence of hidden users In MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3, Special:UserRights exposes the existence of hidden users. |
CVE-2020-25813
GHSA-c4rj-wrmq-52rj |
| VCID-us2t-3nsp-53af | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2011-1580
|
| VCID-v236-3gv8-u3he | Cross-site scripting (XSS) vulnerability in the AJAX module in MediaWiki before 1.6.9, 1.7 before 1.7.2, 1.8 before 1.8.3, and 1.9 before 1.9.0rc2, when wgUseAjax is enabled, allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2007-0177
|
| VCID-v27j-4pnt-n7h9 | Mediawiki BotPassword can bypass CentralAuth's account lock Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock |
CVE-2018-0505
GHSA-5c6w-f4w2-2grp |
| VCID-v3dp-7stt-tygf | MediaWiki: MediaWiki: Cross-site Scripting vulnerability due to improper input neutralization |
CVE-2025-67475
|
| VCID-v6tq-k16u-qbay | Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki 1.3.x before 1.3.11 and 1.4 beta before 1.4 rc1 allow remote attackers to inject arbitrary web script. |
CVE-2005-0534
|
| VCID-v7k4-r4nw-rud8 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer. |
CVE-2010-1647
|
| VCID-va68-tzme-t3dq | Multiple vulnerabilities have been found in MediaWiki, the worst of which could lead to Denial of Service. |
CVE-2013-2114
|
| VCID-va7m-2x57-m7cg | Cross-site request forgery (CSRF) vulnerability in the Special:Import feature in MediaWiki 1.3.0 through 1.6.10, 1.12.x before 1.12.2, and 1.13.x before 1.13.3 allows remote attackers to perform unspecified actions as authenticated users via unknown vectors. |
CVE-2008-5252
|
| VCID-vaaj-f4v8-qbhj | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundation Mediawiki - DiscussionTools Extension allows Regular Expression Exponential Blowup.This issue affects Mediawiki - DiscussionTools Extension: 1.44, 1.43. |
CVE-2025-11175
|
| VCID-vfh6-parb-rqbn | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web script or HTML by editing a wiki page. |
CVE-2008-5250
|
| VCID-vjd5-jv5h-yfhw | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.Js, modules/ve-mw/ui/dialogs/ve.Ui.MWSaveDialog.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-61655
|
| VCID-vm4k-ngu5-9bf8 | Unspecified vulnerability in "edit submission handling" for MediaWiki 1.4.x before 1.4.10 and 1.3.x before 1.3.16 allows remote attackers to cause a denial of service (corruption of the previous submission) via a crafted URL. |
CVE-2005-3166
|
| VCID-vnmh-kbjt-h3bz | Cross-site scripting (XSS) vulnerability in the Special:Block implementation in the getContribsLink function in SpecialBlockip.php in MediaWiki 1.14.0 and 1.15.0 allows remote attackers to inject arbitrary web script or HTML via the ip parameter. |
CVE-2009-4589
|
| VCID-vz1t-x9se-tbcg | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2010-2788
|
| VCID-w3f8-nrqd-p7gq | Mediawiki information disclosure vulnerability Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid |
CVE-2018-0504
GHSA-hr8v-f4g2-p66f |
| VCID-w51y-hprj-buap | Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/actions/RevertAction.Php, includes/api/ApiFileRevert.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1. |
CVE-2025-32696
|
| VCID-wcvz-jgjs-budx | mediawiki: XSS via the useskin parameter |
CVE-2008-4408
|
| VCID-wdhw-9jgd-8yb5 | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-5242
|
| VCID-weh4-ev3r-jyep | security update |
CVE-2017-8812
|
| VCID-wh8d-7n6u-57au | MediaWiki before 1.9.2 allows remote attackers to obtain sensitive information via a direct request to (1) Simple.deps.php, (2) MonoBook.deps.php, (3) MySkin.deps.php, or (4) Chick.deps.php in wiki/skins, which shows the installation path in the resulting error message. |
CVE-2007-0894
|
| VCID-wjx4-aawn-23f6 | security update |
CVE-2017-8810
|
| VCID-wktm-ya6k-v7dv |
CVE-2026-34086
|
|
| VCID-wraf-59ce-u3br | MediaWiki: MediaWiki: Vulnerability in parsing and sanitization |
CVE-2025-67479
|
| VCID-ws1z-1mv2-f7d1 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.6.0 up to versions before 1.6.7 allows remote attackers to inject arbitrary HTML and web script via the edit form. |
CVE-2006-2895
|
| VCID-wzqf-k99e-vbeu | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2022-31091
GHSA-q559-8m2m-g699 GMS-2022-2529 |
| VCID-x8t7-agtn-zudu |
CVE-2026-34087
|
|
| VCID-xdct-ca96-3uat |
CVE-2026-34091
|
|
| VCID-xj9q-7kq3-x7b4 | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-6728
|
| VCID-xjz8-ebps-ckb1 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php. |
CVE-2016-6335
|
| VCID-xqkp-986n-m7f3 | mediawiki: Improper Access Control to protected pages |
CVE-2017-0369
|
| VCID-xs54-b62e-sbbz | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2012-1581
|
| VCID-xtd9-wbd9-67ew | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0. |
CVE-2025-6593
|
| VCID-y2nw-1x3v-73em | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2938
|
| VCID-y9bq-v1bg-7keh | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-6729
|
| VCID-y9bw-g8dr-tkap | MediaWiki 1.11, and other versions before 1.13.3, does not properly protect against the download of backups of deleted images, which might allow remote attackers to obtain sensitive information via requests for files in images/deleted/. |
CVE-2008-5687
|
| VCID-yakw-r8bh-5bde | security update |
CVE-2022-28203
|
| VCID-yc9s-xn4z-jbde | The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624. |
CVE-2015-8623
|
| VCID-yfq4-qg4d-4ubg | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2013-6451
|
| VCID-yp61-wsxj-fbdf | MediaWiki: Two security fixes in v1.15.2 |
CVE-2010-1190
|
| VCID-yr8d-347g-pugg | Wikimedia MediaWik exposed suppressed log in RevisionDelete page Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12470
GHSA-733q-m38x-q7cc |
| VCID-z1we-4qg8-bbcr | Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form. |
CVE-2010-1648
|
| VCID-z3qw-4ejj-uffj | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLMultiSelectField.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1. |
CVE-2025-3469
|
| VCID-z7qu-jq6m-7kgp | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to cause a Denial of Service. |
CVE-2015-2941
|
| VCID-z8qp-v64u-tuh8 | MediaWiki: MediaWiki: Vulnerability in ApiFormatXml.Php requiring high privileges |
CVE-2025-67484
|
| VCID-z9au-wxbn-aqct | Multiple vulnerabilities have been found in MediaWiki, the worst of which leading to remote execution of arbitrary code. |
CVE-2011-0047
|
| VCID-z9d9-aer5-gfa9 | Multiple vulnerabilities have been found in MediaWiki, the worst of which could result in denial of service. |
CVE-2021-41800
GHSA-c8wv-qwwc-6j73 |
| VCID-z9h6-w12c-xqe1 | security update |
CVE-2013-4567
|
| VCID-zcz5-fq86-mkhw | Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0 through 1.13.2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. |
CVE-2008-5249
|
| VCID-zgdf-mxfn-gbea | img_auth.php may leak private extension images into the public cache In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled. |
CVE-2020-15005
GHSA-xpv7-93cm-4mxv |
| VCID-zh21-963v-ekhg | Multiple vulnerabilities have been found in MediaWiki, the worst of which may allow remote attackers to execute arbitrary code. |
CVE-2014-9475
|
| VCID-zhp6-af71-57gk | The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access via a brute-force attack. |
CVE-2015-8626
|
| VCID-zj5a-p9u4-ducw | mediawiki: XSS in youhavenewmessagesmanyusers and youhavenewmessages i18n messages |
CVE-2023-45360
|
| VCID-zmax-894d-5kfd |
CVE-2026-34092
|
|
| VCID-zmzk-jv3z-tub4 | mediawiki: open redirect to external sites |
CVE-2017-0363
|
| VCID-ztxx-cc2c-87at | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. |
CVE-2025-61643
|
| VCID-zz68-pwk2-abew | mediawiki: XSS in SearchHighlighter::highlightText() |
CVE-2017-0365
|