p PatchFirst

PatchFirst · Latest vulnerabilities

mediawiki vulnerabilities · Page 3

Vulnerabilities published for mediawiki in the last 30 days: 16. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 191

  1. CVE-2025-67480

    Low · CVSS 0EPSS 0.25%No fix published

    list=allrevisions can be used to bypass Extension:Lockdown

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2025-67475

    Low · CVSS 0EPSS 0.25%No fix published

    Stored XSS through edit summaries in MW Core

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2025-67476

    Low · CVSS 1.3EPSS 0.29%No fix published

    Importing leaks IP address of importer via EventStreams

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2025-67477

    Low · CVSS 0EPSS 0.25%No fix published

    Stored XSS through a system message in Special:ApiSandbox

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2025-67478

    Low · CVSS 0EPSS 0.35%No fix published

    Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"

    Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUser: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  6. CVE-2025-67479

    Low · CVSS 0EPSS 0.31%No fix published

    Magic word replacement in legacy parser allows using reserved data attributes through wikitext

    Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Cite. This vulnerability is associated with program files includes/Parser/CoreParserFunctions.Php, includes/Parser/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Cite: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  8. CVE-2025-61655

    Low · CVSS 0EPSS 0.17%No fix published

    Stored XSS through system messages in VisualEditor

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve.Init.Mw.DesktopArticleTarget.Js, modules/ve-mw/ui/dialogs/ve.Ui.MWSaveDialog.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  9. CVE-2025-61656

    Low · CVSS 0EPSS 0.18%No fix published

    XSS when pasting into VE

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEditor: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  10. CVE-2025-61657

    Low · CVSS 0EPSS 0.29%No fix published

    CVE-2025-61657

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/stickyHeader.Js. This issue affects Vector: from * before 1.43.4, 1.44.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  11. CVE-2025-61653

    Low · CVSS 2.7EPSS 0.39%No fix published

    Extension:TextExtracts does not check for authorizeRead when returning extracts

    Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associated with program files includes/ApiQueryExtracts.Php. This issue affects TextExtracts: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2025-11261

    Low · CVSS 0EPSS 0.26%No fix published

    Stored i18n XSS exposed by security patch for T402077

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  15. CVE-2025-61645

    Low · CVSS 0EPSS 0.24%No fix published

    CodexTablePager has i18n XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/pager/CodexTablePager.Php. This issue affects MediaWiki: from * before 1.44.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2025-61646

    Low · CVSS 1.2EPSS 0.27%No fix published

    Watchlist group mode reveals authors of edits with hidden authorship

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  17. CVE-2025-61644

    Low · CVSS 0EPSS 0.29%No fix published

    i18n XSS through Special:Watchlist

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from * before > fb856ce9cf121e046305116852cca4899ecb48ca.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  18. CVE-2025-61637

    Low · CVSS 0EPSS 0.25%No fix published

    Stored XSS through system messages in MW Core

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  19. CVE-2025-61638

    Low · CVSS 0EPSS 0.27%No fix published

    Sanitizer::validateAttributes data-XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/Core/Sanitizer.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1; Parsoid: from * before 0.16.6, 0.20.4, 0.21.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  20. CVE-2025-61639

    Low · CVSS 1.7EPSS 0.25%No fix published

    Suppressed blocked IP is visible in Special:BlockList, RC, and other places

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/ManualLogEntry.Php, includes/recentchanges/RecentChangeFactory.Php, includes/recentchanges/RecentChangeStore.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →