p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de mediawiki · Page n° 2

Vulnérabilité publiée pour mediawiki au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 148

  1. CVE-2026-34088

    Faible · CVSS 1.3EPSS 0,29%Aucun correctif publié

    RecentChanges entries expose suppressed content via generated log page html

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  2. CVE-2026-34087

    Moyenne · CVSS 5.1EPSS 0,27%Aucun correctif publié

    Users API leaks whether privileged users have their user groups disabled for lack of 2FA

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  4. CVE-2025-67481

    Faible · CVSS 0EPSS 0,26%Aucun correctif publié

    mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  5. CVE-2025-67482

    Faible · CVSS 1.7EPSS 0,33%Aucun correctif publié

    Lua segfault in unpack()

    Vulnerability in Wikimedia Foundation Scribunto, Wikimedia Foundation luasandbox. This vulnerability is associated with program files includes/Engines/LuaCommon/lualib/mwInit.Lua, library.C. This issue affects Scribunto: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1; luasandbox: from * before fea2304f8f6ab30314369a612f4f5b165e68e95a.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  6. CVE-2025-67483

    Faible · CVSS 0EPSS 0,26%Aucun correctif publié

    Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  7. CVE-2025-67484

    Faible · CVSS 0EPSS 0,45%Aucun correctif publié

    Action API xslt option allows JavaScript execution by administrators who are not interface administrators

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  8. CVE-2025-67480

    Faible · CVSS 0EPSS 0,25%Aucun correctif publié

    list=allrevisions can be used to bypass Extension:Lockdown

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  9. CVE-2025-67475

    Faible · CVSS 0EPSS 0,25%Aucun correctif publié

    Stored XSS through edit summaries in MW Core

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  10. CVE-2025-67476

    Faible · CVSS 1.3EPSS 0,29%Aucun correctif publié

    Importing leaks IP address of importer via EventStreams

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  11. CVE-2025-67477

    Faible · CVSS 0EPSS 0,25%Aucun correctif publié

    Stored XSS through a system message in Special:ApiSandbox

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  12. CVE-2025-67478

    Faible · CVSS 0EPSS 0,35%Aucun correctif publié

    Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"

    Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  13. CVE-2025-67479

    Faible · CVSS 0EPSS 0,31%Aucun correctif publié

    Magic word replacement in legacy parser allows using reserved data attributes through wikitext

    Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Cite: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  15. CVE-2025-61655

    Faible · CVSS 0EPSS 0,17%Aucun correctif publié

    Stored XSS through system messages in VisualEditor

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.Js, modules/ve-mw/ui/dialogs/ve.Ui.MWSaveDialog.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  16. CVE-2025-61656

    Faible · CVSS 0EPSS 0,18%Aucun correctif publié

    XSS when pasting into VE

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  17. CVE-2025-61657

    Faible · CVSS 0EPSS 0,29%Aucun correctif publié

    CVE-2025-61657

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js. This issue affects Vector: from * before 1.43.4, 1.44.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  18. CVE-2025-61653

    Faible · CVSS 2.7EPSS 0,39%Aucun correctif publié

    Extension:TextExtracts does not check for authorizeRead when returning extracts

    Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associated with program files includes/ApiQueryExtracts.Php. This issue affects TextExtracts: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →