ME
Product
Mediawiki
417
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 63Medium 198Low 3
Watch
Add Mediawiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-58025 | 9.8 | Jul 1 | Remote Code Execution via Unsafe Deserialization in LogItem Import Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0 |
| CVE-2025-67484 | 9.8 | Feb 3 | Vulnerability in Wikimedia Foundation MediaWiki Affected: 1.39.0 before 1.39.16; 1.43.0 before 1.43.6; 1.44.0 before 1.44.3; 1.45.0 |
| CVE-2024-34502 | 9.8 | May 5 | An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1 Affected: before 1.39.6; 1.40.0 before 1.40.2; 1.41.0 before 1.41.1 |
| CVE-2023-37303 | 9.8 | Jun 30 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3 Affected: through 1.39.3 |
| CVE-2023-29141 | 9.8 | Mar 31 | An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3 Affected: before 1.35.10; 1.36.0 before 1.38.6; 1.39.0 before 1.39.3 |
| CVE-2022-29906 | 9.8 | Apr 29 | The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user Affected: through 1.37.2 |
| CVE-2022-29904 | 9.8 | Apr 29 | The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with certain '-' and '_' constraints Affected: through 1.37.2 |
| CVE-2022-28209 | 9.8 | Mar 30 | An issue was discovered in Mediawiki through 1.37.1 Affected: through 1.37.1 |
| CVE-2022-28206 | 9.8 | Mar 30 | An issue was discovered in MediaWiki through 1.37.1 Affected: through 1.37.1 |
| CVE-2022-28205 | 9.8 | Mar 30 | An issue was discovered in MediaWiki through 1.37.1 Affected: through 1.37.1 |
| CVE-2021-31556 | 9.8 | Aug 12 | An issue was discovered in the Oauth extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2021-36128 | 9.8 | Jul 2 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36 Affected: through 1.36 |
| CVE-2021-36126 | 9.8 | Jul 2 | An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36 Affected: through 1.36 |
| CVE-2020-10534 | 9.8 | Mar 12 | In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked users re-gaining escalated privileges Affected: through 1.34.0 |
| CVE-2019-12468 | 9.8 | Jul 10 | An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1 Affected: 1.27.0 through 1.32.1 |
| CVE-2017-0372 | 9.8 | Apr 13 | Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities Affected: through 1.23.15; 1.27.0; 1.27.1; 1.27.2; 1.28.0; 1.28.1 |
| CVE-2017-8809 | 9.8 | Nov 15 | api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability Affected: through 1.27.3; 1.28.0; 1.28.1; 1.28.2; 1.29.0; 1.29.1 |
| CVE-2014-9487 | 9.8 | Oct 17 | The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other… Affected: 1.19; 1.19; 1.19; 1.19.0; 1.19.1; 1.19.2; +34 more |
| CVE-2015-8009 | 9.8 | Jul 25 | The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11 does not properly validate the… Affected: through 1.23.10; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.25.0; +2 more |
| CVE-2015-8626 | 9.8 | Mar 23 | The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than… Affected: through 1.23.11; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4; +5 more |
| CVE-2026-8857 | 8.8 | Jul 1 | Full RCE using EasyTimeline Extension Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4 |
| CVE-2026-13706 | 8.8 | Jul 1 | UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0 |
| CVE-2021-46147 | 8.8 | Jan 10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1 |
| CVE-2021-41801 | 8.8 | Oct 11 | The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control Affected: before 1.31.16; 1.35.0 before 1.35.4; 1.36.0 before 1.36.2 |
| CVE-2021-36132 | 8.8 | Jul 2 | An issue was discovered in the FileImporter extension in MediaWiki through 1.36 Affected: through 1.36 |
| CVE-2020-29004 | 8.8 | Jan 29 | The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack Affected: through 1.35 |
| CVE-2020-35626 | 8.8 | Dec 21 | An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1 Affected: through 1.35.1 |
| CVE-2020-35625 | 8.8 | Dec 21 | An issue was discovered in the Widgets extension for MediaWiki through 1.35.1 Affected: through 1.35.1 |
| CVE-2019-12466 | 8.8 | Jul 10 | Wikimedia MediaWiki through 1.32.1 allows CSRF Affected: through 1.32.1 |
| CVE-2017-0367 | 8.8 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure Affected: 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2017-0362 | 8.8 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2015-8624 | 8.8 | Mar 23 | The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token… Affected: through 1.23.11; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4; +5 more |
| CVE-2015-8623 | 8.8 | Mar 23 | The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning,… Affected: through 1.23.11; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4 |
| CVE-2012-4381 | 8.1 | Feb 8 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext… Affected: before 1.18.5; 1.19.0 before 1.19.2 |
| CVE-2017-0361 | 7.8 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2026-13707 | 7.6 | Jul 1 | Session fixation attacks on improperly configured OAuth 1.0a tools Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0 |
| CVE-2026-58036 | 7.5 | Jul 1 | Users API leaks whether privileged users have their user groups disabled for lack of 2FA Affected: 1.46.0 |
| CVE-2026-34092 | 7.5 | May 11 | Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2 |
| CVE-2026-34091 | 7.5 | May 11 | User localization leaked by AbuseFilter + EventStream Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2 |
| CVE-2026-34088 | 7.5 | May 11 | RecentChanges entries expose suppressed content via generated log page html Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2 |
| CVE-2026-34087 | 7.5 | May 11 | Users API leaks whether privileged users have their user groups disabled for lack of 2FA Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2 |
| CVE-2024-40597 | 7.5 | Jul 7 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1 Affected: through 1.42.1 |
| CVE-2024-34506 | 7.5 | May 5 | An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1 Affected: before 1.39.7; 1.40.0 before 1.40.3; 1.41.0 before 1.41.1 |
| CVE-2023-45371 | 7.5 | Oct 9 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0 |
| CVE-2023-45363 | 7.5 | Oct 9 | An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0 |
| CVE-2022-28204 | 7.5 | Sep 19 | A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2 Affected: 1.37.0 before 1.37.2 |
| CVE-2022-28203 | 7.5 | Sep 19 | A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2 Affected: before 1.35.6; 1.36.0 before 1.36.4; 1.37.0 before 1.37.2 |
| CVE-2022-34750 | 7.5 | Jun 28 | An issue was discovered in MediaWiki through 1.38.1 Affected: through 1.38.1 |
| CVE-2022-28323 | 7.5 | Apr 30 | An issue was discovered in MediaWiki through 1.37.2 Affected: through 1.37.2 |
| CVE-2017-0371 | 7.5 | Feb 18 | MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a… Affected: before 1.23.16; 1.24.0 before 1.27.2; 1.28.0 before 1.28.1 |