Low severity · published Oct 17, 2025
CVE-2025-62655
SQL injection in Cargo via Special:CargoExport
2.1
CVSS
0.3%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows SQL Injection.This issue affects MediaWiki Cargo extension: 1.39, 1.43, 1.44.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MC
MediaWiki Cargo extension · The Wikimedia Foundation
1.39; 1.43; 1.44 · source: vendor
Affected product
MC
MediaWiki Cargo extension
The Wikimedia Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-62655
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-62655
phabricator.wikimedia.org
https://phabricator.wikimedia.org/T404016
More from MediaWiki Cargo extension
9.8
CVE-2026-14363
Cargo Extension: SQLi in Special:Drilldown
9.8
CVE-2026-58521
SQLi in Cargo extension via year range filter
6.9
CVE-2026-96878
Cargo Exhibit field alias allows stored XSS
6.9
CVE-2026-96877
Reflected XSS through Cargo Drilldown full-text search
6.9
CVE-2026-96876
Anonymous reflected XSS in CargoExport invalid-alias errors