p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de mediawiki

Vulnérabilité publiée pour mediawiki au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 148

  1. CVE-2026-58025

    Moyenne · CVSS 5.9EPSS 0,5%Aucun correctif publié

    Remote Code Execution via Unsafe Deserialization in LogItem Import

    Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  2. CVE-2026-58029

    Moyenne · CVSS 5.3EPSS 0,35%Aucun correctif publié

    Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  3. CVE-2026-58028

    Faible · CVSS 0EPSS 0,27%Aucun correctif publié

    Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  4. CVE-2026-58026

    Faible · CVSS 0EPSS 0,37%Aucun correctif publié

    $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Parser/Parser.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  5. CVE-2026-58027

    Moyenne · CVSS 5.3EPSS 0,37%Aucun correctif publié

    QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseFilters.Php. This issue affects AbuseFilter: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  6. CVE-2026-58030

    Moyenne · CVSS 5.3EPSS 0,27%Aucun correctif publié

    SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This vulnerability is associated with program files includes/SyntaxHighlight.Php. This issue affects SyntaxHighlight_GeSHi: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  7. CVE-2026-58032

    Moyenne · CVSS 5.3EPSS 0,3%Aucun correctif publié

    mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Api/index.Js. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  8. CVE-2026-58033

    Moyenne · CVSS 5.3EPSS 0,41%Aucun correctif publié

    "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/InfoAction.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  9. CVE-2026-58037

    Faible · CVSS 0EPSS 0,27%Aucun correctif publié

    Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  10. CVE-2026-58036

    Faible · CVSS 2.1EPSS 0,32%Aucun correctif publié

    Users API leaks whether privileged users have their user groups disabled for lack of 2FA

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryAllUsers.Php, includes/Api/ApiQueryUsers.Php, includes/Permissions/PermissionManager.Php, includes/User/UserGroupManager.Php.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  11. CVE-2026-58024

    Moyenne · CVSS 5.1EPSS 0,37%Aucun correctif publié

    API identification of users on private wikis

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiUserrights.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  12. CVE-2026-58031

    Faible · CVSS 0EPSS 0,27%Aucun correctif publié

    Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from 1.46.0-rc.0 before 1.46.0.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  13. CVE-2026-58035

    Faible · CVSS 0EPSS 0,29%Aucun correctif publié

    Stored XSS through a system message in the codex version of Special:Block

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Block/SpecialBlock.Vue.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  14. CVE-2026-5266

    Faible · CVSS 2.3EPSS 0,25%Aucun correctif publié

    CVE-2026-5266

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php. This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  15. CVE-2026-34095

    Faible · CVSS 0EPSS 0,18%Aucun correctif publié

    action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  16. CVE-2026-34094

    Faible · CVSS 2EPSS 0,17%Aucun correctif publié

    Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  17. CVE-2026-34093

    Faible · CVSS 1.1EPSS 0,23%Aucun correctif publié

    Special:UserRights allows viewing user rights from private wiki

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  18. CVE-2026-34092

    Faible · CVSS 2.1EPSS 0,24%Aucun correctif publié

    Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →