ME
Product
Mediawiki
417
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 63Medium 198Low 3
Watch
Add Mediawiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-46149 | 7.5 | Jan 10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1 |
| CVE-2021-44858 | 7.5 | Dec 20 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1 |
| CVE-2021-41799 | 7.5 | Oct 11 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time) Affected: before 1.36.2 |
| CVE-2021-42040 | 7.5 | Oct 6 | An issue was discovered in MediaWiki through 1.36.2 Affected: through 1.36.2 |
| CVE-2021-36125 | 7.5 | Jul 2 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36 Affected: through 1.36 |
| CVE-2021-35197 | 7.5 | Jul 2 | In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access Affected: before 1.31.15; 1.32.0 before 1.35.3; 1.36.0 before 1.36.1 |
| CVE-2021-31555 | 7.5 | Apr 22 | An issue was discovered in the Oauth extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2020-29005 | 7.5 | Jan 29 | The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosure Affected: through 1.35 |
| CVE-2020-35623 | 7.5 | Dec 21 | An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1 Affected: through 1.35.1 |
| CVE-2020-35475 | 7.5 | Dec 18 | In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML Affected: before 1.35.1 |
| CVE-2020-26121 | 7.5 | Sep 27 | An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4 Affected: before 1.34.4 |
| CVE-2020-25869 | 7.5 | Sep 27 | An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4 Affected: before 1.31.10; 1.32.0 before 1.34.4 |
| CVE-2020-25827 | 7.5 | Sep 27 | An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4 Affected: before 1.31.10; 1.32.0 before 1.34.4 |
| CVE-2020-12051 | 7.5 | Apr 21 | The CentralAuth extension through REL1_34 for MediaWiki allows remote attackers to obtain sensitive hidden account information via an… Affected: All versions, or not specified |
| CVE-2013-4572 | 7.5 | Feb 6 | The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is… Affected: before 1.19.9; 1.20 before 1.20.8; 1.21 before 1.21.3 |
| CVE-2013-1817 | 7.5 | Nov 20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information Affected: before 1.19.4; 1.20.0 before 1.20.3 |
| CVE-2013-1816 | 7.5 | Nov 20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request Affected: before 1.19.4; 1.20.0 before 1.20.3 |
| CVE-2012-0046 | 7.5 | Oct 29 | mediawiki allows deleted text to be exposed Affected: before 1.17.2; 1.18.0 before 1.18.1 |
| CVE-2019-12474 | 7.5 | Jul 10 | Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak Affected: 1.23.0 before 1.27.6; 1.30.0 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2 |
| CVE-2019-12473 | 7.5 | Jul 10 | Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS Affected: 1.27.0 before 1.27.6; 1.30.0 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2 |
| CVE-2019-12472 | 7.5 | Jul 10 | An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1 Affected: 1.18.0 before 1.27.6; 1.30.0 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2 |
| CVE-2015-8008 | 7.5 | Dec 29 | The OAuth extension for MediaWiki improperly negotiates a new client token only over Special:OAuth/initiate, which allows attackers to bypass intended IP address access… Affected: before 1.25.3 |
| CVE-2017-8815 | 7.5 | Nov 15 | The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules Affected: through 1.27.3; 1.28.0; 1.28.1; 1.28.2; 1.29.0; 1.29.1 |
| CVE-2017-8814 | 7.5 | Nov 15 | The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a… Affected: through 1.27.3; 1.28.0; 1.28.1; 1.28.2; 1.29.0; 1.29.1 |
| CVE-2017-8810 | 7.5 | Nov 15 | MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending… Affected: through 1.27.3; 1.28.0; 1.28.1; 1.28.2; 1.29.0; 1.29.1 |
| CVE-2012-4380 | 7.5 | Oct 19 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors Affected: through 1.18.4; 1.19.0; 1.19.1 |
| CVE-2016-6337 | 7.5 | Apr 20 | MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after… Affected: 1.27.0 |
| CVE-2016-6335 | 7.5 | Apr 20 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain… Affected: through 1.23.14; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; +1 more |
| CVE-2016-6332 | 7.5 | Apr 20 | MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by… Affected: through 1.23.14; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; +1 more |
| CVE-2016-6331 | 7.5 | Apr 20 | ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to… Affected: through 1.23.14; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; +1 more |
| CVE-2015-8625 | 7.5 | Mar 23 | MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows… Affected: through 1.23.11; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4; +5 more |
| CVE-2024-34507 | 7.4 | May 5 | An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1 Affected: before 1.39.7; 1.40.0 before 1.40.3; 1.41.0 before 1.41.1 |
| CVE-2023-3550 | 7.3 | Sep 25 | Mediawiki v1.40.0 does not validate namespaces used in XML files Affected: 1.40.0 |
| CVE-2026-58029 | 6.5 | Jul 1 | Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0 |
| CVE-2026-58027 | 6.5 | Jul 1 | QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0 |
| CVE-2026-58033 | 6.5 | Jul 1 | "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0 |
| CVE-2025-67480 | 6.5 | Feb 3 | list=allrevisions can be used to bypass Extension:Lockdown Affected: 1.39.0 before 1.39.16; 1.43.0 before 1.43.6; 1.44.0 before 1.44.3; 1.45.0 |
| CVE-2024-40601 | 6.5 | Jul 7 | An issue was discovered in the MediaWikiChat extension for MediaWiki through 1.42.1 Affected: through 1.42.1 |
| CVE-2023-45367 | 6.5 | Oct 9 | An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0 |
| CVE-2023-29139 | 6.5 | Mar 31 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3 Affected: through 1.39.3 |
| CVE-2021-46148 | 6.5 | Jan 10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1 |
| CVE-2021-44857 | 6.5 | Dec 17 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1 |
| CVE-2021-42049 | 6.5 | Oct 6 | An issue was discovered in the Translate extension in MediaWiki through 1.36.2 Affected: through 1.36.2 |
| CVE-2021-31553 | 6.5 | Apr 22 | An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2021-31548 | 6.5 | Apr 22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2019-12470 | 6.5 | Jul 10 | Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control Affected: before 1.27.6; 1.27.7 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2 |
| CVE-2019-12469 | 6.5 | Jul 10 | MediaWiki through 1.32.1 has Incorrect Access Control Affected: before 1.27.6; 1.27.7 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2 |
| CVE-2018-0505 | 6.5 | Oct 4 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock Affected: 1.31.0 before 1.31.1; 1.27.5; 1.29.3; 1.30.1 |
| CVE-2018-0504 | 6.5 | Oct 4 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid Affected: 1.31.0 before 1.31.1; 1.27.5; 1.29.3; 1.30.1 |
| CVE-2017-0369 | 6.5 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |