CVE-2025-53625
CVE-2025-53625 · DynamicPageList3 exposes hidden/suppressed usernames
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. The vulnerability is fixed in 3.6.4.
CVSS 8.7 · High · EPSS 0.5% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
dynamicpagelist3
- Versions
- < 3.6.4: Affected
No fix published
universal-omega/dynamic-page-list3 Packagist
- Versions
- 3.3.10
- 3.3.5
- 3.3.6
- 3.3.7
- 3.3.8
- 3.3.9
- 3.4.0
- 3.4.1
- 3.4.2
- 3.4.3
- 3.4.4
- 3.4.5
- 3.4.6
- 3.5.0
- 3.5.1
- 3.5.2
- 3.6.0
- 3.6.1
- 3.6.2
- 3.6.3
- Affected ranges
- ECOSYSTEM: < 3.6.4
Update to 3.6.4