← Back

Mediawiki

mediawiki

428 CVEs • 18 products

Products (18)

Click to collapse
Toggle
Mediawiki
mediawiki
395 CVEs
Checkuser
checkuser
8 CVEs
Cargo
cargo
7 CVEs
Abusefilter
abusefilter
3 CVEs
Visual Editor
visual_editor
3 CVEs
Mobilefrontend
mobilefrontend
2 CVEs
Mediawiki Botquery Ext
mediawiki_botquery_ext
1 CVE
Mediawik
mediawik
1 CVE
Rssreader
rssreader
1 CVE
Scribunto
scribunto
1 CVE
Skin\
skin\
1 CVE
Shortdescription
shortdescription
1 CVE
Createredirect
createredirect
1 CVE
Rss For Mediawiki
rss_for_mediawiki
1 CVE
Semantic Drilldown
semantic_drilldown
1 CVE
Wikisource Category Browser
wikisource_category_browser
1 CVE
Matomo
matomo
1 CVE
Score
score
1 CVE

CVEs (428)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-34750
1Mediawiki
1Mediawiki
Nov 21, 2024
Jun 28, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be cre...Show more
An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty.Show less
CVE-2022-29969
1Mediawiki
1Rss For Mediawiki
Nov 21, 2024
May 2, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true).
CVE-2022-28323
1Mediawiki
1Mediawiki
Nov 21, 2024
Apr 30, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in MediaWiki through 1.37.2. The SecurePoll extension allows a leak because sorting by timestamp is supported,
CVE-2022-29907
1Mediawiki
1Mediawiki
Nov 21, 2024
Apr 29, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages.
CVE-2022-29906
1Mediawiki
1Mediawiki
Nov 21, 2024
Apr 29, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user.
CVE-2022-29905
1Mediawiki
1Mediawiki
Nov 21, 2024
Apr 29, 2022
N/A· v4
4.3 MEDIUM· v3
4.3 MEDIUM· v2
The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:UserBoxes CSRF.
CVE-2022-29904
1Mediawiki
1Mediawiki
Nov 21, 2024
Apr 29, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with certain '-' and '_' constraints.
CVE-2022-29903
1Mediawiki
1Mediawiki
Nov 21, 2024
Apr 29, 2022
N/A· v4
4.3 MEDIUM· v3
4.3 MEDIUM· v2
The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the extension's configuration. The attacker must trigger a POST reques...Show more
The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the extension's configuration. The attacker must trigger a POST request to Special:PrivateDomains.Show less
CVE-2022-29547
1Mediawiki
1Createredirect
Nov 21, 2024
Apr 21, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target page. This could lead to an unauthorised (or blocked) user being able to edit a pag...Show more
The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target page. This could lead to an unauthorised (or blocked) user being able to edit a page.Show less
CVE-2022-28209
1Mediawiki
1Mediawiki
Nov 21, 2024
Mar 30, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect.
CVE-2022-28206
1Mediawiki
1Mediawiki
Nov 21, 2024
Mar 30, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights.
CVE-2022-28205
1Mediawiki
1Mediawiki
Nov 21, 2024
Mar 30, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future.
CVE-2022-28202
3Debian
FedoraprojectMediawiki
3Debian Linux
FedoraMediawiki
Nov 21, 2024
Mar 30, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Specia...Show more
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.Show less
CVE-2017-0371
1Mediawiki
1Mediawiki
Nov 21, 2024
Feb 18, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within...Show more
MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an attacker-controlled URL in the title attribute.Show less
CVE-2022-21710
1Mediawiki
1Shortdescription
Nov 21, 2024
Jan 24, 2022
N/A· v4
6.1 MEDIUM· v3
4.3 MEDIUM· v2
ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS...Show more
ShortDescription is a MediaWiki extension that provides local short description support. A cross-site scripting (XSS) vulnerability exists in versions prior to 2.3.4. On a wiki that has the ShortDescription enabled, XSS can be triggered on any page or the page with the action=info parameter, which displays the shortdesc property. This is achieved using the wikitext `{{SHORTDESC:<img src=x onerror=alert()>}}`. This issue has a patch in version 2.3.4.Show less
CVE-2021-46150
1Mediawiki
1Mediawiki
Nov 21, 2024
Jan 10, 2022
N/A· v4
4.8 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:Oc...Show more
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October.Show less
CVE-2021-46149
1Mediawiki
1Mediawiki
Nov 21, 2024
Jan 10, 2022
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Searc...Show more
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search.Show less
CVE-2021-46148
1Mediawiki
1Mediawiki
Nov 21, 2024
Jan 10, 2022
N/A· v4
6.5 MEDIUM· v3
4.0 MEDIUM· v2
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffi...Show more
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffic) on a testwiki SecurePoll instance.Show less
CVE-2021-46147
1Mediawiki
1Mediawiki
Nov 21, 2024
Jan 10, 2022
N/A· v4
8.8 HIGH· v3
6.8 MEDIUM· v2
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF.
CVE-2021-46146
1Mediawiki
1Mediawiki
Nov 21, 2024
Jan 10, 2022
N/A· v4
5.4 MEDIUM· v3
3.5 LOW· v2
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file.