Read the docs

mediawiki

Records456All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical20CVSS 9.0–10.0
CVSS high70CVSS 7.0–8.9

Exploited now

mediawiki records in CISA KEV

No mediawiki vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mediawiki 417 records HIGH Cargo 10 records HIGH Checkuser 8 records LOW Abusefilter 3 records LOW Visual Editor 3 records LOW Mobilefrontend 2 records LOW Createredirect 1 record LOW Matomo 1 record LOW

Records

10 records in Cargo · all components

TI-2024-32110 CVE-2024-47849 · GHSA-q7xp-xjgh-vpm7

Backticks can allow the usage of not-allowed SQL functions

Priority HIGH 77

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X befor…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00555 Published 2024-10-05 Fixed in 3.6.1 CWE-89
TI-2026-42112 CVE-2026-58521 · GHSA-9j5g-78q4-mjh2

SQLi in Cargo extension via year range filter

Priority HIGH 70

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00554 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-89
TI-2026-42110 CVE-2026-58519 · GHSA-r23x-87q7-xq2f

Stored XSS through Cargo's map format

Priority HIGH 70

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00241 Published 2026-07-01 Fixed in 3.9.1 CWE-79
TI-2026-12144 CVE-2026-14363 · GHSA-cj99-hcr5-53g3

Cargo Extension: SQLi in Special:Drilldown

Priority HIGH 70

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00523 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-89
TI-2024-32108 CVE-2024-47847 · GHSA-jqvm-9xm2-gc38

Various XSSes found in Cargo

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Car…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0041 Published 2024-10-05 Fixed in 3.6.1 CWE-79
TI-2024-32107 CVE-2024-47846 · GHSA-qfhq-ccm6-g4wq

Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Priority HIGH 70

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00288 Published 2024-10-05 Fixed in 3.6.1 CWE-352
TI-2026-28723 CVE-2026-39841 · GHSA-2mg7-w9r8-29mw

Stored XSS through list fields on Cargo's page values and Special:CargoTables

Priority MEDIUM 61

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8…

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00164 Published 2026-04-07 Fixed in 3.8.7 CWE-80
TI-2026-28721 CVE-2026-39839 · GHSA-r77j-8275-g6jm

Stored XSS through URLs in Cargo's map format

Priority MEDIUM 61

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8…

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00188 Published 2026-04-07 Fixed in 3.8.7 CWE-80
TI-2026-28719 CVE-2026-39837 · GHSA-6m53-gpj2-w66j

Stored XSS through the dynamic table format in Cargo

Priority MEDIUM 61

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00196 Published 2026-04-07 Fixed in 3.8.7 CWE-80
TI-2026-28722 CVE-2026-39840 · GHSA-8m8x-w498-p4wx

CSS injection in multiple Cargo display formats

Priority MEDIUM 56

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00164 Published 2026-04-07 Fixed in 3.8.7 CWE-79
Open these records in search →