Mediawiki
194 CVEs across 19 Mediawiki products. Browse Mediawiki vulnerabilities, severities, and proof-of-concept exploits.
Mediawiki products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14363 | Critical | 9.8 | 2026-07-01 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo… |
CVE-2026-58517 | Medium | 4.3 | 2026-07-01 | Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass. This iss… |
CVE-2026-14358 | Medium | 6.1 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension all… |
CVE-2026-58521 | Critical | 9.8 | 2026-07-01 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo… |
CVE-2026-58520 | Medium | 6.1 | 2026-07-01 | URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing. T… |
CVE-2026-8857 | High | 8.8 | 2026-07-01 | A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This… |
CVE-2026-58038 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline. This vulnerabilit… |
CVE-2026-58037 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58036 | High | 7.5 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-58033 | Medium | 6.5 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-58032 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58030 | Medium | 6.1 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi. This… |
CVE-2026-58029 | Medium | 6.5 | 2026-07-01 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiChangeAuthenticationData.Php, includes/A… |
CVE-2026-58028 | Medium | 5.4 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundati… |
CVE-2026-58027 | Medium | 6.5 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program f… |
CVE-2026-58026 | Medium | 5.7 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-58025 | Critical | 9.8 | 2026-07-01 | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiIm… |
CVE-2026-58024 | Medium | 5.7 | 2026-07-01 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-13707 | High | 7.6 | 2026-07-01 | Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issu… |
CVE-2026-13706 | High | 8.8 | 2026-07-01 | Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils… |
CVE-2026-58035 | Medium | 4.8 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58034 | Medium | 4.8 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerabili… |
CVE-2026-58031 | Medium | 5.4 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerabili… |
CVE-2026-58519 | Medium | 5.4 | 2026-07-01 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allo… |
CVE-2026-58518 | Medium | 6.3 | 2026-07-01 | Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issu… |
CVE-2026-34095 | Medium | 6.1 | 2026-05-11 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/… |
CVE-2026-34094 | Low | 3.8 | 2026-05-11 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWi… |
CVE-2026-34093 | Medium | 5.3 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-34092 | High | 7.5 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program fil… |
CVE-2026-34091 | High | 7.5 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7… |
CVE-2026-34090 | High | 7.5 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1… |
CVE-2026-34088 | High | 7.5 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7… |
CVE-2026-34087 | High | 7.5 | 2026-05-11 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7… |
CVE-2026-39841 | Medium | 6.1 | 2026-04-07 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored X… |
CVE-2026-39840 | Medium | 6.1 | 2026-04-07 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows X… |
CVE-2026-39839 | Medium | 6.1 | 2026-04-07 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored X… |
CVE-2026-39837 | Medium | 5.4 | 2026-04-07 | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This iss… |
CVE-2025-67484 | Critical | 9.8 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiFormatXml.Php. This issue affects MediaWi… |
CVE-2025-67483 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-67481 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-67480 | Medium | 6.5 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affect… |
CVE-2025-67478 | High | 8.8 | 2026-02-03 | Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files includes/Mail/UserMailer.Php. This issue affects CheckUse… |
CVE-2025-67477 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-67476 | Medium | 4.3 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This i… |
CVE-2025-67475 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61658 | Medium | 4.3 | 2026-02-03 | Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/GlobalContributions/GlobalContributionsPager.Php. Thi… |
CVE-2025-61656 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerabil… |
CVE-2025-61655 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerabil… |
CVE-2025-61651 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability… |
CVE-2025-61648 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability… |
CVE-2025-61646 | Medium | 5.4 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issu… |
CVE-2025-61645 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-11261 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61643 | Medium | 6.1 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php. Th… |
CVE-2025-61642 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61641 | Medium | 6.1 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php. This issue affects Med… |
CVE-2025-61640 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61639 | Medium | 4.8 | 2026-02-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files… |
CVE-2025-61638 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundati… |
CVE-2025-61637 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61636 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61634 | Low | 3.1 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php. This issue aff… |
CVE-2026-0669 | High | 7.5 | 2026-01-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Trav… |
CVE-2026-0668 | Medium | 5.3 | 2026-01-07 | Inefficient Regular Expression Complexity vulnerability in Wikimedia Foundation MediaWiki - VisualData Extension allows Regular Expression Exponential Blowup.T… |
CVE-2025-53501 | High | 8.8 | 2025-07-03 | Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Auth… |
CVE-2025-53500 | Medium | 5.6 | 2025-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MassEditRegex Ext… |
CVE-2025-53489 | Medium | 5.6 | 2025-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - GoogleDocs4MW Ext… |
CVE-2025-53490 | Medium | 5.6 | 2025-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - CampaignEvents Ex… |
CVE-2025-53494 | Medium | 6.5 | 2025-07-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - TwoColConflict Ex… |
CVE-2025-53493 | Medium | 6.5 | 2025-07-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extensi… |
CVE-2025-53492 | Low | 3.7 | 2025-07-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MintyDocs Extensi… |
CVE-2024-47849 | Critical | 9.8 | 2024-10-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Inj… |
CVE-2024-47847 | Medium | 6.1 | 2024-10-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows… |
CVE-2024-47846 | High | 8.8 | 2024-10-05 | Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki -… |
CVE-2024-47913 | Medium | 5.3 | 2024-10-04 | An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can… |
CVE-2024-40605 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Foreground skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40604 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Nimbus skin for MediaWiki through 1.42.1. There is Stored XSS via MediaWiki:Nimbus-sidebar menu and submenu entries. |
CVE-2024-40603 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1. Special:ChangeRating allows CSRF to alter data via a GET request. |
CVE-2024-40602 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40601 | Medium | 6.5 | 2024-07-07 | An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1. CSRF can occur in API modules. |
CVE-2024-40600 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40599 | Medium | 4.8 | 2024-07-07 | An issue was discovered in the GuMaxDD skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries. |
CVE-2024-40598 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. (The log_deleted att… |
CVE-2024-40597 | High | 7.5 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. It can expose suppressed information for log events. (The log_deleted attribut… |
CVE-2024-40596 | Medium | 4.3 | 2024-07-07 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log even… |
CVE-2024-34507 | High | 7.4 | 2024-05-05 | An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occu… |
CVE-2024-34506 | High | 7.5 | 2024-05-05 | An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the… |
CVE-2024-34502 | Critical | 9.8 | 2024-05-05 | An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attemp… |
CVE-2024-34500 | Medium | 6.1 | 2024-05-05 | An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an… |
CVE-2024-23179 | Medium | 6.1 | 2024-01-12 | An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via t… |
CVE-2024-23178 | Medium | 5.4 | 2024-01-12 | An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via the phonos-purge-needed-error message. |
CVE-2024-23177 | Medium | 6.1 | 2024-01-12 | An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur via the Special:PageStatistics page parameter. |
CVE-2024-23174 | Medium | 5.4 | 2024-01-12 | An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur v… |
CVE-2024-23173 | Medium | 6.1 | 2024-01-12 | An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldow… |
CVE-2024-23172 | Medium | 5.4 | 2024-01-12 | An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur vi… |
CVE-2024-23171 | Medium | 5.4 | 2024-01-12 | An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special… |
CVE-2023-51704 | Medium | 6.1 | 2023-12-22 | An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php… |
CVE-2023-45362 | Medium | 4.3 | 2023-11-03 | An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. diff-multi-sameuser… |
CVE-2023-45360 | Medium | 5.4 | 2023-11-03 | An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is XSS in youhavenewmessagesmanyusers… |
CVE-2023-45374 | Medium | 5.3 | 2023-10-09 | An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It does not c… |