Debian Mediawiki vulnerabilities

CVE-2014-7295 [LOW] CVE-2014-7295: mediawiki - The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before ... The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting (XSS) attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying MediaWiki:Common.css. Scope: local bookworm: resolved (fixed in 1:1.19.20+

CVE-2025-6591 [NONE] CVE-2025-6591: mediawiki - Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associate... Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0. Scope: local bookworm: resolved (fixed in 1:1.39.13-1~deb12u1) bullseye: resolved (fixed in 1:1.35.13-1+deb11u4) forky: resolved (fixed in 1:1.43.3+dfsg

CVE-2025-6927 [LOW] CVE-2025-6927: mediawiki - Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associate... Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php, includes/api/ApiQueryBlocks.Php. This issue affects MediaWiki: from >= 1.42.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0. Scope: local bookworm: resolved bullseye: resolved forky: resolved (fixed in 1:1.43.3+dfsg-1) sid: resolve

CVE-2014-9475 [LOW] CVE-2014-9475: mediawiki - Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.2... Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message. Scope: local bookworm: resolved (fixed in 1:1.19.20+dfsg-2.2) bullseye: resolved (fixed in 1:1.19.20+dfsg-2.2) forky: res

CVE-2006-0322 [MEDIUM] CVE-2006-0322: mediawiki - Unspecified vulnerability the edit comment formatting functionality in MediaWiki... Unspecified vulnerability the edit comment formatting functionality in MediaWiki 1.5.x before 1.5.6 and 1.4.x before 1.4.14 allows attackers to cause a denial of service (infinite loop) via "certain malformed links." Scope: local bookworm: resolved (fixed in 1.4.15-1) bullseye: resolved (fixed in 1.4.15-1) forky: resolved (fixed in 1.4.15-1) sid: resolved (fixed i

CVE-2025-61653 [LOW] CVE-2025-61653: mediawiki - Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associ... Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associated with program files includes/ApiQueryExtracts.Php. This issue affects TextExtracts: from * before 1.39.14, 1.43.4, 1.44.1. Scope: local bookworm: resolved (fixed in 1:1.39.17-1~deb12u1) bullseye: resolved (fixed in 1:1.35.13-1+deb11u5) forky: resolved (fixed in 1:1.43.5+dfsg-1) sid:

CVE-2025-3469 [NONE] CVE-2025-3469: mediawiki - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site ... Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLMultiSelectField.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1. Scope: local bookworm: resolved (fixed in 1:1.39.12-1~deb12u1)

CVE-2005-3167 [MEDIUM] CVE-2005-3167: mediawiki - Incomplete blacklist vulnerability in MediaWiki before 1.4.11 does not properly ... Incomplete blacklist vulnerability in MediaWiki before 1.4.11 does not properly remove certain CSS inputs (HTML inline style attributes) that are processed as active content by Internet Explorer, which allows remote attackers to conduct cross-site scripting (XSS) attacks. Scope: local bookworm: resolved (fixed in 1.4.11-1) bullseye: resolved (fixed in 1.4.11-1) fo

CVE-2025-6593 [LOW] CVE-2025-6593: mediawiki - Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associate... Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0. Scope: local bookworm: resolved (fixed in 1:1.39.13-1~deb12u1) bullseye: resolved (fixed in 1:1.35.13-1+deb11u4) forky: resolved (fixed in 1:1.43.3+dfsg-1) sid: re

CVE-2008-5250 [LOW] CVE-2008-5250: mediawiki - Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x befo... Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web script or HTML by editing a wiki page. Scope: local bookworm: resolved (f

CVE-2014-3966 [LOW] CVE-2014-3966: mediawiki - Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki b... Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username. Scope: local bookworm: resolved (fixed in 1:1.19.16+dfsg-1) bullseye: resolved (fixed in 1:1.19.16+dfsg-1) for

CVE-2004-2187 [MEDIUM] CVE-2004-2187: mediawiki - Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename val... Unknown vulnerability in ImagePage for MediaWiki 1.3.5, related to "filename validation," has unknown impact and attack vectors. Scope: local bookworm: resolved (fixed in 1.4.9) bullseye: resolved (fixed in 1.4.9) forky: resolved (fixed in 1.4.9) sid: resolved (fixed in 1.4.9) trixie: resolved (fixed in 1.4.9)

CVE-2005-4501 [MEDIUM] CVE-2005-4501: mediawiki - MediaWiki before 1.5.4 uses a hard-coded "internal placeholder string", which al... MediaWiki before 1.5.4 uses a hard-coded "internal placeholder string", which allows remote attackers to bypass protection against cross-site scripting (XSS) attacks and execute Javascript using inline style attributes, which are processed by Internet Explorer. Scope: local bookworm: resolved (fixed in 1.4.13-1) bullseye: resolved (fixed in 1.4.13-1) forky: resolv

CVE-2005-3165 [MEDIUM] CVE-2005-3165: mediawiki - Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.4.9 al... Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.4.9 allow remote attackers to inject arbitrary web script or HTML via (1) tags or (2) Extension or sections that "bypass HTML style attribute restrictions" that are intended to protect against XSS vulnerabilities in Internet Explorer clients. Scope: local bookworm: resolved (fixed in 1.4.9)

CVE-2008-5688 [MEDIUM] CVE-2008-5688: mediawiki - MediaWiki 1.8.1, and other versions before 1.13.3, when the wgShowExceptionDetai... MediaWiki 1.8.1, and other versions before 1.13.3, when the wgShowExceptionDetails variable is enabled, sometimes provides the full installation path in a debugging message, which might allow remote attackers to obtain sensitive information via unspecified requests that trigger an uncaught exception. Scope: local bookworm: resolved (fixed in 1:1.13.3-1) bullseye:

CVE-2022-28201 [MEDIUM] CVE-2022-28201: mediawiki - An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.... An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message. Scope: local bookworm: resolved (fixed in 1:1.35.6-1) bullseye: resolved (fixed in 1:1.35.8-1~deb11u1) forky: resolved (f

CVE-2020-15005 [LOW] CVE-2020-15005: mediawiki - In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1... In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could view them. This occurs because Cache-Control and Vary headers were mishandled. Scope: local bookworm: resolve

CVE-2025-6596 [NONE] CVE-2025-6596: mediawiki - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site ... Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects Vector: from >= 1.40.0 before 1.42.7, 1.43.2, 1.44.0. Scope: local bookwor

CVE-2026-34094 [LOW] CVE-2026-34094: mediawiki bookworm: resolved bullseye: resolved forky: resolved (fixed in 1:1.43.8+dfsg-1) sid: resolved (fixed in 1:1.43.8+dfsg-1) trixie: open

CVE-2025-67482 [LOW] CVE-2025-67482: mediawiki - Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox... Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommon/lualib/mwInit.Lua, library.C. This issue affects Scribunto: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1; luasandbox: from * before fea2304f8f6ab30314369a612f4f5b165e68e95a. Scope: local bookworm: resolved