Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

9 records

Release: Wikimedia Foundation MediaWiki 1.39.14, 1.43.4, 1.44.1 Clear all filters
TI-2025-38071 CVE-2025-61637 · GHSA-j3hj-c3rr-4j34

Stored XSS through system messages in MW Core

Priority LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network High privileges No interaction EPSS 0.00251 Published 2026-02-02 Fixed in 1.39.14, 1.43.4 +1 CWE-79
TI-2025-38072 CVE-2025-61638 · GHSA-mq9h-r82m-hvhc

Sanitizer::validateAttributes data-XSS

Priority LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.00268 Published 2026-02-02 Fixed in 1.39.14, 1.43.4 +4 CWE-79
TI-2025-38076 CVE-2025-61642 · GHSA-cc7r-67vc-28jh

Stored XSS through system messages provided to CodexHtmlForms

Priority LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network High privileges User interaction EPSS 0.00252 Published 2026-02-02 Fixed in 1.39.14, 1.43.4 +1 CWE-79
TI-2025-38070 CVE-2025-61636 · GHSA-7w79-29qq-c7v3

Codex Special:Block vulnerable to message key XSS

Priority LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network No auth No interaction EPSS 0.00243 Published 2026-02-02 Fixed in 1.39.14, 1.43.4 +1 CWE-79