Vulnerabilities

TI-2025-41240 CVE-2025-67481 · GHSA-6898-66v9-cm3x

mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network High privileges No interaction EPSS 0.00253 Published 2026-02-03 Fixed in 1.39.16, 1.43.6 +2 CWE-79

TI-2025-41243 CVE-2025-67484 · GHSA-fq4p-ghcx-qxxg

LOW 3

Vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network High privileges No interaction EPSS 0.00442 Published 2026-02-03 Fixed in 1.39.16, 1.43.6 +2 CWE-20

TI-2025-41239 CVE-2025-67480 · GHSA-wp7p-gm96-p2h8

LOW 2

Vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network Low privileges No interaction EPSS 0.00253 Published 2026-02-03 Fixed in 1.39.16, 1.43.6 +2 CWE-20

TI-2025-41234 CVE-2025-67475 · GHSA-2pvg-g56g-vcf2

LOW 8

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network No auth No interaction EPSS 0.00242 Published 2026-02-03 Fixed in 1.39.16, 1.43.6 +2 CWE-79