Read the docs

Wikimedia Foundation

Records256All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high19CVSS 7.0–8.9

Exploited now

Wikimedia Foundation records in CISA KEV

No Wikimedia Foundation vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wikidata Query Gui 3 records LOW Parsoid 2 records LOW Wikimedia-extensions-css 2 records HIGH Analytics-quarry-web 1 record LOW Apex 1 record HIGH Campaignevents 1 record LOW Mediawiki-extensions-i18ntags 1 record LOW Mediawiki-extensions-uploadwizard 1 record LOW

Records

256 records

TI-2025-11006 CVE-2025-12004 · GHSA-42p2-jfjf-9m59

The compare API module breaks Extension:Lockdown

Priority HIGH 82

Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00401 Published 2025-10-21 Fixed in 1.42 CWE-732
TI-2024-32110 CVE-2024-47849 · GHSA-q7xp-xjgh-vpm7

Backticks can allow the usage of not-allowed SQL functions

Priority HIGH 77

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X befor…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00555 Published 2024-10-05 Fixed in 3.6.1 CWE-89
TI-2026-42112 CVE-2026-58521 · GHSA-9j5g-78q4-mjh2

SQLi in Cargo extension via year range filter

Priority HIGH 70

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00554 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-89
TI-2026-42110 CVE-2026-58519 · GHSA-r23x-87q7-xq2f

Stored XSS through Cargo's map format

Priority HIGH 70

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00241 Published 2026-07-01 Fixed in 3.9.1 CWE-79
TI-2026-28800 CVE-2026-39936 · GHSA-fmf5-9m5j-xgw3

Stored XSS in Score due to usage of non-reserved data attributes

Priority HIGH 70

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allows Cross-Site Scripting (XSS).

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00278 Published 2026-04-07 Fixed in 1.43, 1.44 +1 CWE-79
TI-2026-12144 CVE-2026-14363 · GHSA-cj99-hcr5-53g3

Cargo Extension: SQLi in Special:Drilldown

Priority HIGH 70

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00523 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-89
TI-2025-38893 CVE-2025-62702 · GHSA-crhm-9v62-r3f3

Stored XSS through system messages

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - Page…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00432 Published 2025-10-21 Fixed in 1.44 CWE-79
TI-2025-38892 CVE-2025-62701 · GHSA-65fv-f3rc-p3cx

Stored XSS through system messages

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories:…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00432 Published 2025-10-21 Fixed in 1.44 CWE-79
TI-2025-38887 CVE-2025-62696 · GHSA-2h6r-fgmg-ppfq

Multiple critical security issues in Springboard

Priority HIGH 70

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Media…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0142 Published 2025-10-21 No fix listed CWE-77
TI-2025-38886 CVE-2025-62695 · GHSA-c6h8-mf9p-xjxm

Stored XSS through system messages

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - Wiki…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00432 Published 2025-10-21 No fix listed CWE-79
TI-2025-38885 CVE-2025-62694 · GHSA-fx89-58c6-8m7f

Stored XSS through a system message

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Extension allows Stored XSS.This issue affects Mediawiki - WikiLo…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00481 Published 2025-10-21 No fix listed CWE-79
TI-2025-38872 CVE-2025-62671 · GHSA-gr6v-3pmp-996p

Stored XSS through wikitext in Cargo

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Ext…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0051 Published 2025-10-18 Fixed in 3.8.3 CWE-79
TI-2025-38871 CVE-2025-62670 · GHSA-9qj7-x8cr-xhx2

Stored XSS through a system message in FlexDiagrams

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams Extension allows Stored XSS.This issue affects Mediawiki - Fl…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0051 Published 2025-10-18 No fix listed CWE-79
TI-2025-38870 CVE-2025-62669 · GHSA-54m9-295v-m438

UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks

Priority HIGH 70

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: f…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.005 Published 2025-10-18 Fixed in 1.39 CWE-200
TI-2025-38864 CVE-2025-62663 · GHSA-f2xj-j426-627f

Stored XSS through a system message in UploadWizard

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard Extension allows Stored XSS.This issue affects Mediawiki - Up…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0051 Published 2025-10-18 Fixed in 1.39 CWE-79
TI-2025-38863 CVE-2025-62662 · GHSA-fpf4-m274-fqjj

Stored XSS through system messages in AdvancedSearch

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki -…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0051 Published 2025-10-18 Fixed in 1.39 CWE-79
TI-2025-23187 CVE-2025-32075 · GHSA-5fq6-fcwr-3q76

IP and user agent leaks in Extension:Tabs

Priority HIGH 70

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extension: from 1.39 through 1.43.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00413 Published 2025-04-11 No fix listed CWE-20
TI-2024-32108 CVE-2024-47847 · GHSA-jqvm-9xm2-gc38

Various XSSes found in Cargo

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Car…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0041 Published 2024-10-05 Fixed in 3.6.1 CWE-79
TI-2024-32107 CVE-2024-47846 · GHSA-qfhq-ccm6-g4wq

Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Priority HIGH 70

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00288 Published 2024-10-05 Fixed in 3.6.1 CWE-352
TI-2024-32106 CVE-2024-47845 · GHSA-rxh5-jm9f-fmwj

CSS sanitizer used incorrectly, and is easily bypassed

Priority HIGH 70

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension: from 1.39.X before 1.39.9, from 1.41.X befor…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00407 Published 2024-10-05 Fixed in 1.39.9, 1.41.3 +1 CWE-116
TI-2024-32105 CVE-2024-47841 · GHSA-44q7-44r8-rqj7

Path traversal when loading stylesheets

Priority HIGH 70

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.34566 Published 2024-10-05 Fixed in 1.42.2, 1.41.3 +1 CWE-22
TI-2024-32104 CVE-2024-47840 · GHSA-mmf2-8r78-pm42

Stored XSS through sidebar in Apex skin

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0033 Published 2024-10-05 Fixed in 1.39.9, 1.41.3 +1 CWE-79
Load more
Open these records in search →