Vulnerabilities

TI-2024-15288 CVE-2024-23176 · GHSA-xxr5-62f3-4fpr

Cross-site scripting in mediawiki MassMessage

MEDIUM 58

An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00235 Published 2026-09-14 Fixed in 1.40.2 CWE-79

TI-2023-18883 CVE-2023-37253 · GHSA-37xr-g8rg-4qg9

An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3.

MEDIUM 48

An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.0024 Published 2026-09-14 Fixed in 1.35.11, 1.38.7 +1 CWE-669

TI-2023-18882 CVE-2023-37252 · GHSA-v83r-4pqq-r3wj

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

MEDIUM 48

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

CVSS 3.1LOW 3.1 Network Low privileges No interaction EPSS 0.0024 Published 2026-09-14 Fixed in 1.35.11, 1.38.7 +1 CWE-669

TI-2026-12144 CVE-2026-14363 · GHSA-cj99-hcr5-53g3

Cargo Extension: SQLi in Special:Drilldown

HIGH 70

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00523 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-89

TI-2026-12140 CVE-2026-14358 · GHSA-f5m8-q8gq-mjpw

Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title

LOW 30

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS).

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00298 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-79

TI-2026-42108 CVE-2026-58517 · GHSA-9r5v-wvvq-6v9f

Blocked users can create and edit WikiLambda objects

LOW 36

Improper neutralization of input terminators vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Authentication Bypass.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00329 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-288

TI-2026-42112 CVE-2026-58521 · GHSA-9j5g-78q4-mjh2

SQLi in Cargo extension via year range filter

HIGH 70

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00554 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-89

TI-2026-42111 CVE-2026-58520 · GHSA-q84p-w2wj-782m

UrlShortener defaults to ineffective validation open to third-party redirects

LOW 36

URL redirection to untrusted site ('open redirect') vulnerability in The Wikimedia Foundation Mediawiki - UrlShortener Extension allows Cross-Site Flashing.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00282 Published 2026-07-01 Fixed in 1.43.9, 1.44.6 +1 CWE-601

TI-2026-41780 CVE-2026-58025 · GHSA-28rr-rpqp-g8c8

Remote Code Execution via Unsafe Deserialization in LogItem Import

LOW 27

Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.9 Network High privileges No interaction EPSS 0.00503 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-502

TI-2026-41784 CVE-2026-58029 · GHSA-gpg7-6j8p-9wg5

Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata

LOW 24

Vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00351 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-287

TI-2026-41783 CVE-2026-58028 · GHSA-jqc3-4vrw-8965

Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets

LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth.

CVSS 4.0N/A 0.0 Network Low privileges No interaction EPSS 0.00267 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41781 CVE-2026-58026 · GHSA-jp4p-rf6v-wv5p

$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces

LOW 3

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.00369 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-200

TI-2026-07780 CVE-2026-8857 · GHSA-q6xp-j96f-7vmp

Full RCE using EasyTimeline Extension

LOW 7

A vulnerability in Wikimedia Foundation timeline.

CVSS 4.0N/A 0.0 Network Low privileges No interaction EPSS 0.02098 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-94

TI-2026-41793 CVE-2026-58038 · GHSA-pm32-8hr8-567h

Stored XSS through javascript URLs in SVGs generated by EasyTimeline

LOW 3

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation timeline.

CVSS 4.0N/A 0.0 Network Low privileges No interaction EPSS 0.00273 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41782 CVE-2026-58027 · GHSA-xf4f-w4h8-w7rr

QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI

LOW 24

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00371 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-200

TI-2026-41785 CVE-2026-58030 · GHSA-vmx6-3fp5-595p

SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute

LOW 24

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation SyntaxHighlight_GeSHi.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.0027 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41787 CVE-2026-58032 · GHSA-2pj3-wqpx-g8cm

mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html

LOW 24

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00299 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41788 CVE-2026-58033 · GHSA-r39h-799c-h846

"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted

LOW 24

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00413 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-200

TI-2026-41792 CVE-2026-58037 · GHSA-c9c4-xmc2-5h6x

Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input

LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.0027 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-79

TI-2026-41791 CVE-2026-58036 · GHSA-qf2r-x8qv-xrwx

Users API leaks whether privileged users have their user groups disabled for lack of 2FA

LOW 11

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.0032 Published 2026-07-01 Fixed in 1.46.0 CWE-200

TI-2026-41779 CVE-2026-58024 · GHSA-5mf7-4fq5-g3gp

API identification of users on private wikis

LOW 23

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00369 Published 2026-07-01 Fixed in 1.46.0, 1.45.4 +2 CWE-200

TI-2026-11556 CVE-2026-13707 · GHSA-qjj7-573r-4398

Session fixation attacks on improperly configured OAuth 1.0a tools

LOW 3

Session fixation vulnerability in Wikimedia Foundation OAuth.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.00344 Published 2026-07-01 No fix listed CWE-384

TI-2026-11555 CVE-2026-13706 · GHSA-v4ch-5p7w-6w58

UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG

LOW 3

Improper input validation vulnerability in Wikimedia Foundation UrlShortener.

CVSS 4.0N/A 0.0 Network Low privileges No interaction EPSS 0.00479 Published 2026-07-01 No fix listed CWE-20

TI-2026-41786 CVE-2026-58031 · GHSA-f942-cxv6-p9mx

Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected

LOW 2

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.

CVSS 4.0N/A 0.0 Network Low privileges User interaction EPSS 0.00267 Published 2026-07-01 Fixed in 1.46.0 CWE-79

TI-2026-41789 CVE-2026-58034 · GHSA-5m8f-rxqc-4gpj

Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts

LOW 3

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser.

CVSS 4.0N/A 0.0 Network High privileges User interaction EPSS 0.00287 Published 2026-07-01 Fixed in 1.46.0 CWE-79

Vulnerabilities

Filters