Mediawiki
Page 2 of 2 — Mediawiki CVEs from a corpus of 194, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-45373 | Medium | 6.1 | 2023-10-09 | An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. XSS can occ… |
CVE-2023-45372 | Medium | 5.3 | 2023-10-09 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merg… |
CVE-2023-45371 | High | 7.5 | 2023-10-09 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate… |
CVE-2023-45370 | Medium | 5.3 | 2023-10-09 | An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams… |
CVE-2023-45369 | Medium | 4.3 | 2023-10-09 | An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Usernames of h… |
CVE-2023-45367 | Medium | 6.5 | 2023-10-09 | An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. A user can use… |
CVE-2023-45364 | Medium | 5.3 | 2023-10-09 | An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. Deleted revision existence is l… |
CVE-2023-45363 | High | 7.5 | 2023-10-09 | An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to ca… |
CVE-2023-3550 | High | 7.3 | 2023-09-25 | Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a… |
CVE-2023-36674 | Medium | 5.3 | 2023-08-20 | An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. It is possible to byp… |
CVE-2023-37305 | Medium | 5.3 | 2023-06-30 | An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/Page/PageContentHandler.php and includes/… |
CVE-2023-37304 | Medium | 5.4 | 2023-06-30 | An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS via the column alignment feature. |
CVE-2023-37303 | Critical | 9.8 | 2023-06-30 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to block a user fails after a temporary brow… |
CVE-2023-37302 | Medium | 6.1 | 2023-06-30 | An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to… |
CVE-2023-37301 | Medium | 5.3 | 2023-06-30 | An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended int… |
CVE-2023-37300 | Medium | 5.3 | 2023-06-30 | An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3. There is incorrect access control for visibility of hi… |
CVE-2023-37256 | Medium | 6.1 | 2023-06-29 | An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links the… |
CVE-2023-37255 | Medium | 6.1 | 2023-06-29 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the "get edits" type is vulnerable to HTML in… |
CVE-2023-37254 | Medium | 6.1 | 2023-06-29 | An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a crafted page item when using the default… |
CVE-2023-37251 | Medium | 6.1 | 2023-06-29 | An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly esc… |
CVE-2023-36675 | Medium | 6.1 | 2023-06-26 | An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter… |
CVE-2022-41766 | Medium | 4.3 | 2023-05-29 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. Upon an action=rollback operation, the alreadyro… |
CVE-2020-29007 | Critical | 9.8 | 2023-04-15 | The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allow… |
CVE-2021-30153 | Medium | 4.3 | 2023-04-15 | An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. . When using VisualEditor to edit a… |
CVE-2023-29141 | Critical | 9.8 | 2023-03-31 | An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. An auto-block can occur for an untrusted X-… |
CVE-2023-29140 | Medium | 5.3 | 2023-03-31 | An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. Attackers might be able to see edits for which the username has been h… |
CVE-2023-29139 | Medium | 6.5 | 2023-03-31 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with checkuserlog permissions makes many CheckUserLog API requests… |
CVE-2023-29137 | Medium | 4.3 | 2023-03-31 | An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. The UserImpactHandler for GrowthExperiments inadvertently returns the… |
CVE-2017-20175 | Low | 2.6 | 2023-02-05 | A vulnerability classified as problematic has been found in DaSchTour matomo-mediawiki-extension up to 2.4.2 on MediaWiki. This affects an unknown part of the… |
CVE-2022-39193 | Medium | 5.3 | 2023-01-20 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose information on the performer o… |
CVE-2023-22912 | Medium | 5.3 | 2023-01-20 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. CheckUser TokenManager insecurely uses AES-C… |
CVE-2023-22910 | Medium | 5.4 | 2023-01-20 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase date formatting via… |
CVE-2015-10058 | Low | 3.5 | 2023-01-17 | A vulnerability, which was classified as problematic, was found in Wikisource Category Browser. This affects an unknown part of the file index.php. The manipul… |
CVE-2022-47927 | Medium | 5.5 | 2023-01-12 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data dir… |
CVE-2023-22945 | Medium | 4.3 | 2023-01-11 | In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll a… |
CVE-2023-22911 | Medium | 6.1 | 2023-01-10 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML at… |
CVE-2023-22909 | Medium | 5.3 | 2023-01-10 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. SpecialMobileHistory allows remote attackers… |
CVE-2022-41767 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When changes made by an IP address are reassigne… |
CVE-2022-41765 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUserTextField exposes the existence of hidde… |
CVE-2021-44856 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A title blocked by AbuseFilter can be created via Special:C… |
CVE-2021-44855 | Medium | 5.4 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image fea… |
CVE-2021-44854 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The REST API publicly caches results from private wikis. |
CVE-2022-4561 | Low | 3.5 | 2022-12-16 | A vulnerability classified as problematic has been found in SemanticDrilldown Extension. Affected is the function printFilterLine of the file includes/specials… |
CVE-2021-42049 | Medium | 6.5 | 2022-09-29 | An issue was discovered in the Translate extension in MediaWiki through 1.36.2. Oversighters cannot undo revisions or oversight on pages where they suppressed… |
CVE-2021-42048 | Medium | 4.8 | 2022-09-29 | An issue was discovered in the Growth extension in MediaWiki through 1.36.2. Any admin can add arbitrary JavaScript code to the Newcomer home page footer, whic… |
CVE-2021-42047 | Medium | 5.4 | 2022-09-29 | An issue was discovered in the Growth extension in MediaWiki through 1.36.2. On any Wiki with the Mentor Dashboard feature enabled, users can login with a ment… |
CVE-2021-42046 | Medium | 6.1 | 2022-09-29 | An issue was discovered in the GlobalWatchlist extension in MediaWiki through 1.36.2. The rev-deleted-user and ntimes messages were not properly escaped and al… |
CVE-2021-42045 | Medium | 5.4 | 2022-09-29 | An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2. Simple polls allow users to create alerts by changing their User-Age… |
CVE-2022-28204 | High | 7.5 | 2022-09-19 | A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere&target=Property%3AP31&namesp… |
CVE-2022-28203 | High | 7.5 | 2022-09-19 | A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special… |
CVE-2022-28201 | Medium | 4.4 | 2022-09-19 | An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinit… |
CVE-2022-39194 | Medium | 4.9 | 2022-09-02 | An issue was discovered in the MediaWiki through 1.38.2. The community configuration pages for the GrowthExperiments extension could cause a site to become una… |
CVE-2022-34912 | Medium | 6.1 | 2022-07-02 | An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title with… |
CVE-2022-34911 | Medium | 6.1 | 2022-07-02 | An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a Jav… |
CVE-2022-34750 | High | 7.5 | 2022-06-28 | An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this le… |
CVE-2022-29969 | Medium | 6.1 | 2022-05-02 | The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true). |
CVE-2022-28323 | High | 7.5 | 2022-04-30 | An issue was discovered in MediaWiki through 1.37.2. The SecurePoll extension allows a leak because sorting by timestamp is supported, |
CVE-2022-29907 | Medium | 6.1 | 2022-04-29 | The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages. |
CVE-2022-29906 | Critical | 9.8 | 2022-04-29 | The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin u… |
CVE-2022-29905 | Medium | 4.3 | 2022-04-29 | The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:UserBoxes CSRF. |
CVE-2022-29904 | Critical | 9.8 | 2022-04-29 | The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with certain '-' and '_' co… |
CVE-2022-29903 | Medium | 4.3 | 2022-04-29 | The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the exten… |
CVE-2022-29547 | High | 7.5 | 2022-04-21 | The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target page. This could lead… |
CVE-2022-28209 | Critical | 9.8 | 2022-03-30 | An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect. |
CVE-2022-28206 | Critical | 9.8 | 2022-03-30 | An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights. |
CVE-2022-28205 | Critical | 9.8 | 2022-03-30 | An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future. |
CVE-2022-28202 | Medium | 6.1 | 2022-03-30 | An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties… |
CVE-2017-0371 | High | 7.5 | 2022-02-18 | MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors v… |
CVE-2022-21710 | Medium | 4.7 | 2022-01-24 | ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to… |
CVE-2021-46150 | Medium | 4.8 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date m… |
CVE-2021-46149 | High | 7.5 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplis… |
CVE-2021-46148 | Medium | 6.5 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (… |
CVE-2021-46147 | High | 8.8 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF. |
CVE-2021-46146 | Medium | 5.4 | 2022-01-10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via th… |
CVE-2021-45474 | Medium | 6.1 | 2021-12-24 | In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter. |
CVE-2021-45473 | Medium | 6.1 | 2021-12-24 | In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar). |
CVE-2021-45472 | Medium | 6.1 | 2021-12-24 | In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution ma… |
CVE-2021-45471 | Medium | 5.3 | 2021-12-24 | In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items. |
CVE-2021-44858 | High | 7.5 | 2021-12-20 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=… |
CVE-2021-45038 | Medium | 5.3 | 2021-12-17 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view priva… |
CVE-2021-44857 | Medium | 6.5 | 2021-12-17 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcr… |
CVE-2021-41801 | High | 8.8 | 2021-10-11 | The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run… |
CVE-2021-41800 | Medium | 5.3 | 2021-10-11 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometime… |
CVE-2021-41799 | High | 7.5 | 2021-10-11 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). ApiQueryBacklinks (action=query&list=backli… |
CVE-2021-41798 | Medium | 6.1 | 2021-10-11 | MediaWiki before 1.36.2 allows XSS. Month related MediaWiki messages are not escaped before being used on the Special:Search results page. |
CVE-2021-42044 | Medium | 4.8 | 2021-10-06 | An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2. The Growthexperiments-mentor-dashboard-mentee-o… |
CVE-2021-42043 | Medium | 6.1 | 2021-10-06 | An issue was discovered in Special:MediaSearch in the MediaSearch extension in MediaWiki through 1.36.2. The suggestion text (a parameter to mediasearch-did-yo… |
CVE-2021-42042 | Medium | 4.8 | 2021-10-06 | An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2. The growthexperiments-edit-config-error-inva… |
CVE-2021-42041 | Medium | 6.1 | 2021-10-06 | An issue was discovered in CentralAuth in MediaWiki through 1.36.2. The rightsnone MediaWiki message was not being properly sanitized and allowed for the injec… |
CVE-2021-42040 | High | 7.5 | 2021-10-06 | An issue was discovered in MediaWiki through 1.36.2. A parser function related to loop control allowed for an infinite loop (and php-fpm hang) within the Loops… |
CVE-2021-31556 | Critical | 9.8 | 2021-08-12 | An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. MWOAuthConsumerSubmitControl.php does not ensure that the length of an RSA key wil… |
CVE-2021-36132 | High | 8.8 | 2021-07-02 | An issue was discovered in the FileImporter extension in MediaWiki through 1.36. For certain relaxed configurations of the $wgFileImporterRequiredRight variabl… |
CVE-2021-36131 | Medium | 4.8 | 2021-07-02 | An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36. Within several special pages, a privileged user could inject arbitrary HTML… |
CVE-2021-36130 | Medium | 4.8 | 2021-07-02 | An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awa… |
CVE-2021-36129 | Medium | 4.3 | 2021-07-02 | An issue was discovered in the Translate extension in MediaWiki through 1.36. The Aggregategroups Action API module does not validate the parameter for aggrega… |
CVE-2021-36128 | Critical | 9.8 | 2021-07-02 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. Autoblocks for CentralAuth-issued suppression blocks are not properly implement… |
CVE-2021-36127 | Medium | 4.3 | 2021-07-02 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalUserRights page provided search results which, for a suppress… |
CVE-2021-36126 | Critical | 9.8 | 2021-07-02 | An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content lang… |
CVE-2021-36125 | High | 7.5 | 2021-07-02 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalRenameRequest page is vulnerable to infinite loops and denial… |
CVE-2021-35197 | High | 7.5 | 2021-07-02 | In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "… |