p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de mediawiki

Vulnérabilités publiées pour mediawiki au cours des 30 derniers jours : 16. Présentes dans le catalogue KEV : 0.

RSS ↗ JSON ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 163

  12. CVE-2026-103051

    Moyenne · CVSS 6.1EPSS 0,15%Aucun correctif publié

    Stored i18n XSSs in CentralNotice

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralNotice extension allows Stored XSS. This issue affects Mediawiki - CentralNotice extension: before 1.46.1, 1.45.5, 1.43.10.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  13. CVE-2026-103050

    Moyenne · CVSS 6.1EPSS 0,15%Aucun correctif publié

    Stored i18n XSS in MassMessage

    Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - MassMessage extension allows Stored XSS. This issue affects Mediawiki - MassMessage extension: before 1.46.1, 1.45.5, 1.43.10.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  16. CVE-2026-103044

    Critique · CVSS 9.8EPSS 0,44%Aucun correctif publié

    EasyTimeline should not serve image maps as application/xml

    XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection. This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  17. CVE-2026-52854

    Élevée · CVSS 8.6EPSS 0,58%Aucun correctif publié

    mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function

    Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control label without escaping it. A wiki user with the edit permission can store malicious wikitext that causes script execution when another user previews or views the affected map. The script executes in the viewing user's browser session and can access data or perform actions available to that user. This issue is fix

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  18. CVE-2026-58025

    Moyenne · CVSS 5.9EPSS 0,5%Aucun correctif publié

    Remote Code Execution via Unsafe Deserialization in LogItem Import

    Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  19. CVE-2026-58029

    Moyenne · CVSS 5.3EPSS 0,35%Aucun correctif publié

    Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/Api/ApiLinkAccount.Php, includes/Api/ApiRemoveAuthenticationData.Php, includes/Specials/SpecialLinkAccounts.Php, includes/Specials/SpecialUnlinkAccounts.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

  20. CVE-2026-58028

    Faible · CVSS 0EPSS 0,27%Aucun correctif publié

    Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php, includes/ResourceLoader/Module.Php, includes/Hooks/Handlers/PageDisplayHookHandler.Php, includes/LogFormatter/PermissionChangeLogFormatter.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9; CentralAuth: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9.

    mediawikiSystèmes d’exploitation
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →