mediawiki

Records456All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical20CVSS 9.0–10.0

CVSS high70CVSS 7.0–8.9

Exploited now

mediawiki records in CISA KEV

No mediawiki vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Mediawiki 417 records HIGH Cargo 10 records HIGH Checkuser 8 records LOW Abusefilter 3 records LOW Visual Editor 3 records LOW Mobilefrontend 2 records LOW Createredirect 1 record LOW Matomo 1 record LOW

Records

417 records in Mediawiki · all components

TI-2023-18933 CVE-2023-37303 · GHSA-frhg-fmpg-fqp2

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

HIGH 82

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00953 Published 2023-06-30 No fix listed CWE-754

TI-2023-13576 CVE-2023-29141 · GHSA-5vj8-g3qg-4qh6

An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6…

HIGH 82

An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01194 Published 2023-03-31 Partial fix · 1.39.3, 1.38.6 +1 CWE-444

TI-2023-03312 CVE-2023-3550 · GHSA-4pqg-hr8r-h5cw

Stored XSS leads to privilege escalation in MediaWiki v1.40.0

HIGH 74

Mediawiki v1.40.0 does not validate namespaces used in XML files.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.0138 Published 2023-09-25 Will not fix CWE-79

TI-2026-42109 CVE-2026-58518 · GHSA-vjf9-r75w-m9fv

Cross-site request forgery in Wikimedia Foundation Mediawiki - RedirectManager Extension

HIGH 70

Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00129 Published 2026-07-01 Fixed in 1.3.3 CWE-352

TI-2024-22822 CVE-2024-34507 · GHSA-gwp7-78vh-mpmm

An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki…

HIGH 66

An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1.

CVSS 3.1HIGH 7.4 Network No auth User interaction EPSS 0.00674 Published 2024-05-05 Will not fix CWE-80

TI-2023-18935 CVE-2023-37305 · GHSA-qpx9-w5wp-x7q5

An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki…

MEDIUM 63

An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00614 Published 2023-06-30 No fix listed CWE-203

TI-2023-18931 CVE-2023-37301 · GHSA-8vqm-pj2f-g578

An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3.

MEDIUM 63

An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00335 Published 2023-06-30 No fix listed CWE-326

TI-2023-18930 CVE-2023-37300 · GHSA-7jff-vjgp-2fjv

An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki…

MEDIUM 63

An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00672 Published 2023-06-30 No fix listed CWE-863

TI-2023-09050 CVE-2023-22912 · GHSA-x2pr-v49f-hmmm

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5…

MEDIUM 63

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00393 Published 2023-01-20 No fix listed CWE-330

TI-2022-18573 CVE-2022-39193 · GHSA-5jq2-gw2c-fg5h

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x.

MEDIUM 63

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00607 Published 2023-01-20 Will not fix CWE-200

TI-2023-13574 CVE-2023-29139 · GHSA-j4f5-gw7r-fr82

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

MEDIUM 62

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00582 Published 2023-03-31 No fix listed CWE-400

TI-2024-27025 CVE-2024-40600 · GHSA-x6x9-24j8-5vh6

An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1.

MEDIUM 60

An issue was discovered in the Metrolook skin for MediaWiki through 1.42.1.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00302 Published 2024-07-06 No fix listed CWE-79

TI-2024-15291 CVE-2024-23179 · GHSA-37v9-q385-wr5j

An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2.

MEDIUM 60

An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00429 Published 2024-01-12 No fix listed CWE-79

TI-2024-15289 CVE-2024-23177 · GHSA-xj97-9w9q-ffjp

An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2.

MEDIUM 60

An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00424 Published 2024-01-12 No fix listed CWE-79

TI-2024-15286 CVE-2024-23173 · GHSA-rhpm-63w5-79rg

An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x…

MEDIUM 60

An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00424 Published 2024-01-12 Fixed in 1.35.14, 1.39.6 +1 CWE-79

TI-2023-18932 CVE-2023-37302 · GHSA-fmrf-p77g-vv5c

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3.

MEDIUM 60

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00689 Published 2023-06-30 No fix listed CWE-79

TI-2023-18886 CVE-2023-37256 · GHSA-655h-vxcr-6q9j

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3.

MEDIUM 60

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00467 Published 2023-06-29 No fix listed CWE-79

TI-2023-18885 CVE-2023-37255 · GHSA-c5v4-mrjh-44fj

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

MEDIUM 60

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00467 Published 2023-06-29 No fix listed CWE-79

TI-2023-18884 CVE-2023-37254 · GHSA-mrm7-9wh5-q689

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3.

MEDIUM 60

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00467 Published 2023-06-29 No fix listed CWE-79

TI-2023-18490 CVE-2023-36675 · GHSA-q7gg-775p-p35h

An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7…

MEDIUM 60

An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00829 Published 2023-06-26 Will not fix CWE-79

TI-2023-24321 CVE-2023-45363 · GHSA-w5fx-cx7f-6vr9

An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through…

MEDIUM 59

An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.23783 Published 2023-10-09 Fixed in 1.35.12, 1.39.5 +1 CWE-835

TI-2022-12255 CVE-2022-29904 · GHSA-j3c3-76w9-jg8q

The SemanticDrilldown extension for MediaWiki through 1.37.2 (before…

MEDIUM 59

The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with certain '-' and '_' constraints.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.16802 Published 2022-04-29 No fix listed CWE-89

TI-2024-15290 CVE-2024-23178 · GHSA-wwvh-g99g-xv29

An issue was discovered in the Phonos extension in MediaWiki before 1.40.2.

MEDIUM 58

An issue was discovered in the Phonos extension in MediaWiki before 1.40.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00406 Published 2024-01-12 No fix listed CWE-79

TI-2024-15284 CVE-2024-23171 · GHSA-46pr-fphr-qq4h

An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14…

MEDIUM 58

An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00406 Published 2024-01-12 No fix listed CWE-79

TI-2023-24318 CVE-2023-45360 · GHSA-qpc2-222x-ppq9

An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5…

MEDIUM 58

An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00659 Published 2023-11-03 Will not fix CWE-79

Open these records in search →