p PatchFirst

PatchFirst · Latest vulnerabilities

mediawiki vulnerabilities · Page 4

Vulnerabilities published for mediawiki in the last 30 days: 0. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 148

  1. CVE-2025-6595

    Low · CVSS 0EPSS 0.31%No fix published

    CVE-2025-6595

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MultimediaViewer.This issue affects MultimediaViewer: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  2. CVE-2025-6596

    Low · CVSS 0EPSS 0.43%No fix published

    Vector inserts portlet labels as HTML, allowing for stored XSS through system messages

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js. This issue affects Vector: from >= 1.40.0 before 1.42.7, 1.43.2, 1.44.0.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  3. CVE-2025-6597

    Low · CVSS 0EPSS 0.51%No fix published

    MediaWiki should not consider autocreation as login for the purposes of security reauthentication

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  4. CVE-2025-6927

    Low · CVSS 2.3EPSS 0.51%No fix published

    Autoblocks from global account suppressions are publicly visible

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php, includes/api/ApiQueryBlocks.Php. This issue affects MediaWiki: from >= 1.42.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  5. CVE-2025-11175

    High · CVSS 8.8EPSS 0.47%No fix published

    DiscussionTools should use better regex

    Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundation Mediawiki - DiscussionTools Extension allows Regular Expression Exponential Blowup.This issue affects Mediawiki - DiscussionTools Extension: 1.44, 1.43.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  6. CVE-2025-12004

    Critical · CVSS 10EPSS 0.4%No fix published

    The compare API module breaks Extension:Lockdown

    Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  11. CVE-2025-62696

    Medium · CVSS 6.9EPSS 1.42%No fix published

    Multiple critical security issues in Springboard

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Mediawiki Foundation - Springboard Extension: master.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  12. CVE-2025-62699

    Medium · CVSS 6.9EPSS 0.37%No fix published

    Special:Translate tool does not use the correct IP and User-Agent in the CheckUser tool

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Translate extension appears to use jobs to make edits to translation pages. This causes the CheckUser tool to log the wrong IP and User-Agent making these edits un-auditable via the CheckUser tool.This issue affects Mediawiki - Translate Extension: from master before 1.39.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  13. CVE-2025-62658

    High · CVSS 7.5EPSS 0.24%No fix published

    SQL injection in WatchAnalytics through Special:ClearPendingReviews

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extension allows SQL Injection.This issue affects MediaWiki WatchAnalytics extension: 1.43, 1.44.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  14. CVE-2025-62657

    Medium · CVSS 5.8EPSS 0.27%No fix published

    Stored XSS through system messages in PageForms

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PageForms extension allows Stored XSS.This issue affects MediaWiki PageForms extension: 1.44.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  15. CVE-2025-62656

    Medium · CVSS 5.8EPSS 0.27%No fix published

    GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki GlobalBlocking extension allows Stored XSS.This issue affects MediaWiki GlobalBlocking extension: 1.43, 1.44.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗

  16. CVE-2025-62697

    High · CVSS 8.8EPSS 0.35%No fix published

    Improperly sanitized style parameter in LanguageSelector

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - LanguageSelector Extension allows Code Injection.This issue affects Mediawiki - LanguageSelector Extension: from master before 1.39.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  17. CVE-2025-62698

    Medium · CVSS 6.9EPSS 0.34%No fix published

    Stored XSS through system messages in ExternalGuidance

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuidance allows Stored XSS.This issue affects Mediawiki - ExternalGuidance: from master before 1.39.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  18. CVE-2025-62700

    Medium · CVSS 6.9EPSS 0.34%No fix published

    Stored XSS through a system message in MultiBoilerplate

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - MultiBoilerplate Extensionmaste allows Stored XSS.This issue affects Mediawiki - MultiBoilerplate Extensionmaste: from master before 1.39.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  19. CVE-2025-62693

    Medium · CVSS 6.9EPSS 0.34%No fix published

    Stored XSS through system messages in LastModified

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - LastModified Extension allows Stored XSS.This issue affects Mediawiki - LastModified Extension: from master before 1.39.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  20. CVE-2025-61766

    Medium · CVSS 6.5EPSS 0.39%No fix published

    Bucket vulnerable to infinite recursion when querying a bucket using the != operator

    Bucket is a MediaWiki extension to store and retrieve structured data on articles. Prior to version 1.0.0, infinite recursion can occur if a user queries a bucket using the `!=` comparator. This will result in PHP's call stack limit exceeding, and/or increased memory consumption, potentially leading to a denial of service. Version 1.0.0 contains a patch for the issue.

    mediawikiOperating systems
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →