Wikimedia Foundation Mediawiki vulnerabilities

38 known vulnerabilities affecting wikimedia_foundation/mediawiki.

Total CVEs

CISA KEV

Public exploits

Exploited in wild

Severity breakdown

HIGH1MEDIUM4LOW11

Vulnerabilities

Page 2 of 2

CVE-2025-61644UNKNOWNCVSS 0.0≥ *, < > fb856ce9cf121e046305116852cca4899ecb48ca2026-02-03

CVE-2025-61644 [NONE] CWE-79 CVE-2025-61644: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from * before > fb856ce9cf121e046305116852cca4899ecb48ca.

nvd

CVE-2025-6590MEDIUMCVSS 4.6≥ *, ≤ 1.39.12, 1.42.76 1.43.1, 1.44.02026-02-02

CVE-2025-6590 [MEDIUM] CWE-200 CVE-2025-6590: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLUserTextField.Php. This issue affects MediaWiki: from * through 1.39.12, 1.42.76 1.43.1, 1.44.0.

nvd

CVE-2025-6589LOWCVSS 2.1v>= 1.42.02026-02-02

CVE-2025-6589 [LOW] CWE-22 CVE-2025-6589: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php. This issue affects MediaWiki: >= 1.42.0.

nvd

CVE-2025-6593LOWCVSS 2.1≥ 1.27.0, < 1.39.13, 1.42.7 1.43.2, 1.44.02026-02-02

CVE-2025-6593 [LOW] CWE-200 CVE-2025-6593: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

nvd

CVE-2025-6927LOWCVSS 2.3≥ >= 1.42.0, < 1.39.13, 1.42.7 1.43.2, 1.44.02026-02-02

CVE-2025-6927 [LOW] CWE-22 CVE-2025-6927: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php, includes/api/ApiQueryBlocks.Php. This issue affects MediaWiki: from >= 1.42.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

nvd

CVE-2025-6594UNKNOWNCVSS 0.0≥ 1.27.0, < 1.39.13, 1.42.7 1.43.2, 1.44.02026-02-02

CVE-2025-6594 [NONE] CWE-79 CVE-2025-6594: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

nvd

CVE-2025-6591UNKNOWNCVSS 0.0≥ *, < 1.39.13, 1.42.7 1.43.2, 1.44.02026-02-02

CVE-2025-6591 [NONE] CWE-79 CVE-2025-6591: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0.

nvd

CVE-2025-6597UNKNOWNCVSS 0.0≥ *, < 1.39.13, 1.42.7, 1.43.2, 1.44.02026-02-02

CVE-2025-6597 [NONE] CWE-22 CVE-2025-6597: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.

nvd

CVE-2025-32700LOWCVSS 2.3≥ >= 1.43.0, < 1.43.12025-04-10

CVE-2025-32700 [LOW] CWE-200 CVE-2025-32700: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Abu Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseLog.Php, includes/Pager/AbuseLogPager.Php, includes/Special/SpecialAbuseLog.Php, includes/View/AbuseFilterViewExamine.Php. This issue affects AbuseFilter: from >= 1.43.

nvd

CVE-2025-32699LOWCVSS 2.1fixed in 1.39.12, 1.42.6, 1.43.12025-04-10

CVE-2025-32699 [LOW] CWE-74 CVE-2025-32699: Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects Med Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.16.5, 0.19.2, 0.20.2.

nvd

CVE-2025-32698LOWCVSS 2.1fixed in 1.39.12, 1.42.6, 1.43.12025-04-10

CVE-2025-32698 [LOW] CWE-200 CVE-2025-32698: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/LogPager.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.

nvd

CVE-2025-3469UNKNOWNCVSS 0.0fixed in 1.39.12, 1.42.6, 1.43.12025-04-10

CVE-2025-3469 [NONE] CWE-79 CVE-2025-3469: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLMultiSelectField.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.

nvd

CVE-2025-32696UNKNOWNCVSS 0.0fixed in 1.39.12, 1.42.6, 1.43.12025-04-10

CVE-2025-32696 [NONE] CWE-281 CVE-2025-32696: Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerabi Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/actions/RevertAction.Php, includes/api/ApiFileRevert.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.

nvd

CVE-2025-32697UNKNOWNCVSS 0.0fixed in 1.42.6, 1.43.12025-04-10

CVE-2025-32697 [NONE] CWE-281 CVE-2025-32697: Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerabi Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/IntroMessageBuilder.Php, includes/Permissions/PermissionManager.Php, includes/Permissions/RestrictionStore.Php. This issue affects MediaWiki: before 1.42.6, 1.43.1.

nvd

CVE-2013-4572HIGHCVSS 7.5vbefore 1.19.9v1.20.x before 1.20.8+1 more2020-02-06

CVE-2013-4572 [HIGH] CWE-384 CVE-2013-4572: The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.2 The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.

nvd

CVE-2013-6451MEDIUMCVSS 6.1v1.19.9 before 1.19.10v1.2x before 1.21.4+1 more2020-01-28

CVE-2013-6451 [MEDIUM] CWE-79 CVE-2013-6451: Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values.

nvd

CVE-2013-6455MEDIUMCVSS 5.3vbefore 1.19.10v1.2x before 1.21.4+1 more2020-01-28

CVE-2013-6455 [MEDIUM] CWE-200 CVE-2013-6455: The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.

nvd

CVE-2013-4303MEDIUMCVSS 6.1v1.19.x before 1.19.8v1.20.x before 1.20.7+1 more2019-12-11

CVE-2013-4303 [MEDIUM] CWE-79 CVE-2013-4303: includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x befo includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query

nvd

← Previous2 / 2