miraheze

Records23All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high3CVSS 7.0–8.9

Exploited now

miraheze records in CISA KEV

No miraheze vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Managewiki 5 records MEDIUM Createwiki 4 records LOW Globalnewfiles 2 records LOW Wikidiscover 2 records MEDIUM Datadump 1 record LOW

Records

23 records

TI-2024-16562 CVE-2024-25107

Cross-Site Scripting in WikiDiscover

MEDIUM 60

WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00402 Published 2024-02-08 Fixed in 267e763a0d7 CWE-79

TI-2021-10196 CVE-2021-29483

wikiconfig API leaked private config variables set through ManageWiki

MEDIUM 43

ManageWiki is an extension to the MediaWiki project.

CVSS 3.1CRITICAL 9.4 Network No auth No interaction EPSS 0.01211 Published 2021-04-28 No fix listed CWE-200

TI-2025-33333 CVE-2025-53371

DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs

LOW 39

DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel.

CVSS 3.1CRITICAL 9.1 Network Low privileges No interaction EPSS 0.00382 Published 2025-07-10 Fixed in 1f20d850cbcce5b15951c7c6127b87b927a5415e CWE-400

TI-2025-23966 CVE-2025-32956

ManageWiki has SQL injection vulnerability in NamespaceMigrationJob

LOW 38

ManageWiki is a MediaWiki extension allowing users to manage wikis.

CVSS 3.1HIGH 8.0 Network Low privileges User interaction EPSS 0.00678 Published 2025-04-21 No fix listed CWE-89

TI-2026-23374 CVE-2026-29788 · GHSA-gfhq-7499-f3f2

TSPortal: Anyone can forge self-deletion requests of any user

LOW 36

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work.

CVSS 4.0HIGH 8.4 Network No auth User interaction EPSS 0.00295 Published 2026-03-06 Fixed in 30 CWE-1287

TI-2024-32057 CVE-2024-47782

Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover

LOW 33

WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00338 Published 2024-10-07 No fix listed CWE-79

TI-2022-08626 CVE-2022-24813

Authentication Bypass Using an Alternate Path or Channel in CreateWiki

LOW 32

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01008 Published 2022-04-04 No fix listed CWE-287

TI-2021-12390 CVE-2021-32722

Uncontrolled Resource Consumption in GlobalNewFiles

LOW 32

GlobalNewFiles is a mediawiki extension.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01332 Published 2021-06-28 Fixed in 48be7adb70568e20e961ea1cb70904454a671b1d CWE-400

TI-2024-19666 CVE-2024-29898

Oversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikis

LOW 30

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00691 Published 2024-03-28 No fix listed CWE-200

TI-2026-25934 CVE-2026-33541 · GHSA-f346-8rp3-4h9h

TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service

LOW 29

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00304 Published 2026-03-26 Fixed in 34 CWE-400

TI-2024-22999 CVE-2024-34701

CreateWiki vulnerable to impersonation of wiki requester

LOW 29

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00647 Published 2024-05-13 Fixed in 02e0f298f8d35155c39aa74193cb7b867432c5b8 CWE-863

TI-2024-16564 CVE-2024-25109

Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki

LOW 29

ManageWiki is a MediaWiki extension allowing users to manage wikis.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00448 Published 2024-02-09 Fixed in 6942e8b2c01dc33c2c41a471f91ef3f6ca726073 CWE-79

TI-2021-16572 CVE-2021-39186

Improper Input Validation in GlobalNewFiles

LOW 29

GlobalNewFiles is a MediaWiki extension maintained by Miraheze.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01006 Published 2021-09-01 No fix listed CWE-20

TI-2024-32083 CVE-2024-47816

Users can impersonate import requesters if their actor IDs coincide in ImportDump

LOW 28

ImportDump is a mediawiki extension designed to automate user import requests.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00334 Published 2024-10-09 No fix listed CWE-282

TI-2021-12441 CVE-2021-32774

Cross-Site Request Forgery (CSRF) in DataDump

LOW 28

DataDump is a MediaWiki extension that provides dumps of wikis.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00476 Published 2021-07-20 Fixed in 67a82b76e186925330b89ace9c5fd893a300830b CWE-352

TI-2024-32082 CVE-2024-47815

Cross-site Scripting in IncidentReporting

LOW 27

IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00419 Published 2024-10-09 No fix listed CWE-79

TI-2024-32079 CVE-2024-47812

Cross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDump

LOW 27

ImportDump is an extension for mediawiki designed to automate user import requests.

CVSS 3.1MEDIUM 6.0 Network High privileges No interaction EPSS 0.00412 Published 2024-10-09 No fix listed CWE-79

TI-2025-28445 CVE-2025-43861

ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection

LOW 24

ManageWiki is a MediaWiki extension allowing users to manage wikis.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00265 Published 2025-04-24 Fixed in 2f177dc CWE-79

TI-2024-32056 CVE-2024-47781

Cross-site Scripting (XSS) in Special:RequestWikiQueue when displaying sitename in CreateWiki

LOW 24

CreateWiki is an extension used at Miraheze for requesting & creating wikis.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00327 Published 2024-10-07 No fix listed CWE-79

TI-2024-19665 CVE-2024-29897

CreateWiki Leak of suppressed wiki requests outside of `CreateWikiGlobalWiki`

LOW 24

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00708 Published 2024-03-28 Fixed in 23415c17ffb4832667c06abcf1eadadefd4c8937 CWE-200

TI-2024-19652 CVE-2024-29883

CreateWiki's wiki request suppression ignores the suppression settings set by the suppressor

LOW 23

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00603 Published 2024-03-26 Fixed in 0c7c4f93834349be8f5c2a678e9a85b4b1aa7bab CWE-200

TI-2025-23974 CVE-2025-32964

Improper authorization in miraheze ManageWiki

LOW 21

ManageWiki is a MediaWiki extension allowing users to manage wikis.

CVSS 3.1MEDIUM 4.6 Network Low privileges User interaction EPSS 0.0022 Published 2025-04-22 Fixed in 00bebea CWE-285

TI-2024-31892 CVE-2024-47612

XSS in Special:DataDump when displaying dump status

LOW 17

DataDump is a MediaWiki extension that provides dumps of wikis.

CVSS 3.1LOW 3.5 Network High privileges User interaction EPSS 0.00335 Published 2024-10-02 Fixed in 601688ee8e8808a23b102fa305b178f27cbd226d CWE-79

Open these records in search →