p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de mediawiki · Página 3

Vulnerabilidades publicadas para mediawiki en los últimos 30 días: 9. Incluidas en el catálogo KEV: 0.

RSS ↗ JSON ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 295

  1. CVE-2025-61657

    Baja · CVSS 0EPSS 0,29%Corrección disponible

    CVE-2025-61657

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js. This issue affects Vector: from * before 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  2. CVE-2025-61653

    Baja · CVSS 2.7EPSS 0,39%Corrección disponible

    Extension:TextExtracts does not check for authorizeRead when returning extracts

    Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associated with program files includes/ApiQueryExtracts.Php. This issue affects TextExtracts: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  3. CVE-2025-61652

    Baja · CVSS 2.7EPSS 0,3%Corrección disponible

    Action API discussiontoolspageinfo does not check for authorizeRead for the page

    Vulnerability in Wikimedia Foundation DiscussionTools.This issue affects DiscussionTools: from * before 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  4. CVE-2025-11173

    Baja · CVSS 0EPSS 0,4%Corrección disponible

    Reauth for enabling 2FA can be bypassed by submitting a form

    Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated with program files src/Special/OATHManage.Php. This issue affects OATHAuth: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2025-11261

    Baja · CVSS 0EPSS 0,26%Corrección disponible

    Stored i18n XSS exposed by security patch for T402077

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  6. CVE-2025-61646

    Baja · CVSS 1.2EPSS 0,27%Corrección disponible

    Watchlist group mode reveals authors of edits with hidden authorship

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  7. CVE-2025-61637

    Baja · CVSS 0EPSS 0,26%Corrección disponible

    Stored XSS through system messages in MW Core

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  8. CVE-2025-61638

    Baja · CVSS 0EPSS 0,27%Corrección disponible

    Sanitizer::validateAttributes data-XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Parsoid: from * before 0.16.6, 0.20.4, 0.21.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  9. CVE-2025-61639

    Baja · CVSS 1.7EPSS 0,26%Corrección disponible

    Suppressed blocked IP is visible in Special:BlockList, RC, and other places

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/ManualLogEntry.Php, includes/recentchanges/RecentChangeFactory.Php, includes/recentchanges/RecentChangeStore.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  10. CVE-2025-61640

    Baja · CVSS 0EPSS 0,25%Corrección disponible

    Stored XSS through system messages in Special:RecentChangesLinked (MW Core)

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  11. CVE-2025-61641

    Baja · CVSS 1.7EPSS 0,32%Corrección disponible

    API list=allpages with maxsize is making really slow queries

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  12. CVE-2025-61642

    Baja · CVSS 0EPSS 0,26%Corrección disponible

    Stored XSS through system messages provided to CodexHtmlForms

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/CodexHTMLForm.Php, includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  13. CVE-2025-61643

    Baja · CVSS 2.7EPSS 0,27%Corrección disponible

    EventStreams publishes suppressed recent change entries that are suppressed from their creation

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  14. CVE-2025-61634

    Baja · CVSS 0EPSS 0,32%Corrección disponible

    HTML rest endpoint needs PoolCounter and proper parser cache check

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  15. CVE-2025-61635

    Baja · CVSS 0EPSS 0,4%Corrección disponible

    Add rate limiting to ApiFancyCaptchaReload

    Vulnerability in Wikimedia Foundation ConfirmEdit. This vulnerability is associated with program files includes/FancyCaptcha/ApiFancyCaptchaReload.Php. This issue affects ConfirmEdit: *.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  16. CVE-2025-61636

    Baja · CVSS 0EPSS 0,25%Corrección disponible

    Codex Special:Block vulnerable to message key XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.6+dfsg-1~deb13u1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  17. CVE-2025-6589

    Baja · CVSS 2.1EPSS 0,49%Corrección disponible

    With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php. This issue affects MediaWiki: >= 1.42.0.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.3+dfsg-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  18. CVE-2025-6590

    Media · CVSS 4.6EPSS 0,37%Corrección disponible

    Complete content leak of private wikis due to PasswordReset Wikitext injection in error message

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLUserTextField.Php. This issue affects MediaWiki: from * through 1.39.12, 1.42.76 1.43.1, 1.44.0.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.3+dfsg-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  19. CVE-2025-6591

    Baja · CVSS 0EPSS 0,45%Corrección disponible

    HTML injection in API action=feedcontributions output from i18n message

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.3+dfsg-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

  20. CVE-2025-6592

    Baja · CVSS 2.1EPSS 0,41%Corrección disponible

    Creating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLog

    Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0.

    mediawikiSistemas operativos
    • Actualiza a 1:1.43.3+dfsg-1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →