mediawiki

Records456All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical20CVSS 9.0–10.0

CVSS high70CVSS 7.0–8.9

Exploited now

mediawiki records in CISA KEV

No mediawiki vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mediawiki 417 records HIGH Cargo 10 records HIGH Checkuser 8 records LOW Abusefilter 3 records LOW Visual Editor 3 records LOW Mobilefrontend 2 records LOW Createredirect 1 record LOW Matomo 1 record LOW

Records

456 records

TI-2023-18933 CVE-2023-37303 · GHSA-frhg-fmpg-fqp2

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

HIGH 82

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00953 Published 2023-06-30 No fix listed CWE-754

TI-2023-13576 CVE-2023-29141 · GHSA-5vj8-g3qg-4qh6

An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6…

HIGH 82

An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01194 Published 2023-03-31 Partial fix · 1.39.3, 1.38.6 +1 CWE-444

TI-2020-17515 CVE-2020-29007 · GHSA-v67w-wjqm-h9pj

The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability…

HIGH 82

The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02336 Published 2023-04-15 No fix listed CWE-94

TI-2024-32110 CVE-2024-47849 · GHSA-q7xp-xjgh-vpm7

Backticks can allow the usage of not-allowed SQL functions

HIGH 77

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X befor…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00555 Published 2024-10-05 Fixed in 3.6.1 CWE-89

TI-2023-03312 CVE-2023-3550 · GHSA-4pqg-hr8r-h5cw

Stored XSS leads to privilege escalation in MediaWiki v1.40.0

HIGH 74

Mediawiki v1.40.0 does not validate namespaces used in XML files.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.0138 Published 2023-09-25 Will not fix CWE-79

TI-2026-42112 CVE-2026-58521 · GHSA-9j5g-78q4-mjh2

SQLi in Cargo extension via year range filter

HIGH 70

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00554 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-89

TI-2026-42110 CVE-2026-58519 · GHSA-r23x-87q7-xq2f

Stored XSS through Cargo's map format

HIGH 70

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00241 Published 2026-07-01 Fixed in 3.9.1 CWE-79

TI-2026-42109 CVE-2026-58518 · GHSA-vjf9-r75w-m9fv

Cross-site request forgery in Wikimedia Foundation Mediawiki - RedirectManager Extension

HIGH 70

Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00129 Published 2026-07-01 Fixed in 1.3.3 CWE-352

TI-2026-12144 CVE-2026-14363 · GHSA-cj99-hcr5-53g3

Cargo Extension: SQLi in Special:Drilldown

HIGH 70

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00523 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-89

TI-2024-32108 CVE-2024-47847 · GHSA-jqvm-9xm2-gc38

Various XSSes found in Cargo

HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Car…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0041 Published 2024-10-05 Fixed in 3.6.1 CWE-79

TI-2024-32107 CVE-2024-47846 · GHSA-qfhq-ccm6-g4wq

Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

HIGH 70

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00288 Published 2024-10-05 Fixed in 3.6.1 CWE-352

TI-2024-22822 CVE-2024-34507 · GHSA-gwp7-78vh-mpmm

An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki…

HIGH 66

An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00674 Published 2024-05-05 Will not fix CWE-80

TI-2023-18935 CVE-2023-37305 · GHSA-qpx9-w5wp-x7q5

An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki…

MEDIUM 63

An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00614 Published 2023-06-30 No fix listed CWE-203

TI-2023-18931 CVE-2023-37301 · GHSA-8vqm-pj2f-g578

An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3.

MEDIUM 63

An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00335 Published 2023-06-30 No fix listed CWE-326

TI-2023-18930 CVE-2023-37300 · GHSA-7jff-vjgp-2fjv

An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki…

MEDIUM 63

An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00672 Published 2023-06-30 No fix listed CWE-863

TI-2023-09050 CVE-2023-22912 · GHSA-x2pr-v49f-hmmm

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5…

MEDIUM 63

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00393 Published 2023-01-20 No fix listed CWE-330

TI-2022-18573 CVE-2022-39193 · GHSA-5jq2-gw2c-fg5h

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x.

MEDIUM 63

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00607 Published 2023-01-20 Will not fix CWE-200

TI-2023-13574 CVE-2023-29139 · GHSA-j4f5-gw7r-fr82

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

MEDIUM 62

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00582 Published 2023-03-31 No fix listed CWE-400

TI-2026-28723 CVE-2026-39841 · GHSA-2mg7-w9r8-29mw

Stored XSS through list fields on Cargo's page values and Special:CargoTables

MEDIUM 61

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8…

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00164 Published 2026-04-07 Fixed in 3.8.7 CWE-80

TI-2026-28721 CVE-2026-39839 · GHSA-r77j-8275-g6jm

Stored XSS through URLs in Cargo's map format

MEDIUM 61

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00188 Published 2026-04-07 Fixed in 3.8.7 CWE-80

TI-2026-28719 CVE-2026-39837 · GHSA-6m53-gpj2-w66j

Stored XSS through the dynamic table format in Cargo

MEDIUM 61

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00196 Published 2026-04-07 Fixed in 3.8.7 CWE-80

TI-2024-27025 CVE-2024-40600 · GHSA-x6x9-24j8-5vh6

An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1.

MEDIUM 60

An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00302 Published 2024-07-06 No fix listed CWE-79

TI-2024-15291 CVE-2024-23179 · GHSA-37v9-q385-wr5j

An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2.

MEDIUM 60

An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00429 Published 2024-01-12 No fix listed CWE-79

TI-2024-15289 CVE-2024-23177 · GHSA-xj97-9w9q-ffjp

An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2.

MEDIUM 60

An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00424 Published 2024-01-12 No fix listed CWE-79

TI-2024-15286 CVE-2024-23173 · GHSA-rhpm-63w5-79rg

An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x…

MEDIUM 60

An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00424 Published 2024-01-12 Fixed in 1.35.14, 1.39.6 +1 CWE-79

Open these records in search →