cbcvebase.

Wikimedia Foundation Mediawiki vulnerabilities

55 known vulnerabilities affecting wikimedia_foundation/mediawiki.

Total CVEs
55
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
CRITICAL2HIGH5MEDIUM33LOW8

Vulnerabilities

Page 2 of 3
CVE-2026-58037P4MEDIUMCVSS 6.1≥ *, < 1.46.0, 1.45.4, 1.44.6, 1.43.92026-07-01
CVE-2026-58037 [MEDIUM] CWE-79 CVE-2026-58037: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/L
nvd
CVE-2013-6455P4MEDIUMCVSS 5.3vbefore 1.19.10v1.2x before 1.21.4+1 more2020-01-28
CVE-2013-6455 [MEDIUM] CWE-200 CVE-2013-6455: The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the names to the DOM of a page.
nvd
CVE-2025-67481P4MEDIUMCVSS 6.1≥ *, < 1.39.16, 1.43.6, 1.44.3, 1.45.12026-02-03
CVE-2025-67481 [MEDIUM] CWE-79 CVE-2025-67481: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.
nvd
CVE-2025-67475P4MEDIUMCVSS 6.1≥ *, < 1.39.16, 1.43.6, 1.44.3, 1.45.12026-02-03
CVE-2025-67475 [MEDIUM] CWE-79 CVE-2025-67475: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.
nvd
CVE-2025-61645P4MEDIUMCVSS 6.1≥ *, < 1.44.12026-02-03
CVE-2025-61645 [MEDIUM] CWE-79 CVE-2025-61645: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/pager/CodexTablePager.Php. This issue affects MediaWiki: from * before 1.44.1.
nvd
CVE-2026-58032P4MEDIUMCVSS 6.1≥ *, < 1.46.0, 1.45.4, 1.44.6, 1.43.92026-07-01
CVE-2026-58032 [MEDIUM] CWE-79 CVE-2026-58032: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.
nvd
CVE-2025-6590P4MEDIUMCVSS 4.6≥ *, ≤ 1.39.12, 1.42.76 1.43.1, 1.44.02026-02-02
CVE-2025-6590 [MEDIUM] CWE-200 CVE-2025-6590: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLUserTextField.Php. This issue affects MediaWiki: from * through 1.39.12, 1.42.76 1.43.1, 1.44.0.
nvd
CVE-2025-11261P4MEDIUMCVSS 6.1≥ *, < 1.39.15, 1.43.5, 1.44.22026-02-03
CVE-2025-11261 [MEDIUM] CWE-79 CVE-2025-11261: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.
nvd
CVE-2025-67483P4MEDIUMCVSS 6.1≥ *, < 1.43.6, 1.44.3, 1.45.12026-02-03
CVE-2025-67483 [MEDIUM] CWE-79 CVE-2025-67483: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.
nvd
CVE-2025-67477P4MEDIUMCVSS 6.1≥ *, < 1.44.3, 1.45.12026-02-03
CVE-2025-67477 [MEDIUM] CWE-79 CVE-2025-67477: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.
nvd
CVE-2013-6451P4MEDIUMCVSS 6.1v1.19.9 before 1.19.10v1.2x before 1.21.4+1 more2020-01-28
CVE-2013-6451 [MEDIUM] CWE-79 CVE-2013-6451: Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or HTML via unspecified CSS values.
nvd
CVE-2026-58031P4MEDIUMCVSS 5.4≥ 1.46.0-rc.0, < 1.46.02026-07-01
CVE-2026-58031 [MEDIUM] CWE-79 CVE-2026-58031: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.
nvd
CVE-2025-6594P4MEDIUMCVSS 4.7≥ 1.27.0, < 1.39.13, 1.42.7 1.43.2, 1.44.02026-02-02
CVE-2025-6594 [MEDIUM] CWE-79 CVE-2025-6594: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.
nvd
CVE-2025-61639P4MEDIUMCVSS 4.8≥ *, < 1.39.14, 1.43.4, 1.44.12026-02-03
CVE-2025-61639 [MEDIUM] CWE-200 CVE-2025-61639: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Med Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/ManualLogEntry.Php, includes/recentchanges/RecentChangeFactory.Php, includes/recentchanges/RecentChangeStore.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4
nvd
CVE-2025-67476P4MEDIUMCVSS 4.3≥ *, < 1.44.3, 1.45.12026-02-03
CVE-2025-67476 [MEDIUM] CVE-2025-67476: Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.
nvd
CVE-2025-61638P4MEDIUMCVSS 4.8≥ *, < 1.39.14, 1.43.4, 1.44.12026-02-03
CVE-2025-61638 [MEDIUM] CWE-79 CVE-2025-61638: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Pars
nvd
CVE-2025-61637P4MEDIUMCVSS 4.8≥ *, < 1.39.14, 1.43.4, 1.44.12026-02-03
CVE-2025-61637 [MEDIUM] CWE-79 CVE-2025-61637: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.39.14,
nvd
CVE-2025-61636P4MEDIUMCVSS 4.8≥ *, < 1.39.14, 1.43.4, 1.44.12026-02-03
CVE-2025-61636 [MEDIUM] CWE-79 CVE-2025-61636: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
nvd
CVE-2026-58035P4MEDIUMCVSS 4.8≥ 1.46.0-rc.0, < 1.46.02026-07-01
CVE-2026-58035 [MEDIUM] CWE-79 CVE-2026-58035: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue.
nvd
CVE-2025-61640P4MEDIUMCVSS 4.8≥ *, < 1.39.14, 1.43.4, 1.44.12026-02-03
CVE-2025-61640 [MEDIUM] CWE-79 CVE-2025-61640: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerab Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.
nvd
← Previous2 / 3Next →