ME
Product
Mediawiki
417
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 63Medium 198Low 3
Watch
Add Mediawiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-45360 | 5.4 | Nov 3 | An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.39.0 before 1.39.5; 1.40.0; 1.40.0 |
| CVE-2023-37304 | 5.4 | Jun 30 | An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3 Affected: through 1.39.3 |
| CVE-2023-22910 | 5.4 | Jan 20 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1 Affected: before 1.35.9; 1.36.0 before 1.38.5; 1.39.0; 1.39.0; 1.39.0 |
| CVE-2021-44855 | 5.4 | Dec 26 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0; 1.37.0; 1.37.0; 1.37.0 |
| CVE-2021-46146 | 5.4 | Jan 10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1 |
| CVE-2021-42045 | 5.4 | Oct 6 | An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2 Affected: through 1.36.2 |
| CVE-2021-42047 | 5.4 | Oct 6 | An issue was discovered in the Growth extension in MediaWiki through 1.36.2 Affected: through 1.36.2 |
| CVE-2021-31554 | 5.4 | Apr 22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2021-31552 | 5.4 | Apr 22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2021-31550 | 5.4 | Apr 22 | An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2020-29003 | 5.4 | Nov 24 | The PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll question, entered during Special:CreatePoll or Special:UpdatePoll Affected: through 1.35 |
| CVE-2020-27957 | 5.4 | Oct 28 | The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data Affected: through 1.35 |
| CVE-2017-0366 | 5.4 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2026-34093 | 5.3 | May 11 | Special:UserRights allows viewing user rights from private wiki Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2 |
| CVE-2024-47913 | 5.3 | Oct 4 | An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2 Affected: before 1.39.9; 1.40.0 before 1.41.3; 1.42.0 before 1.42.2 |
| CVE-2023-45374 | 5.3 | Oct 9 | An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0 |
| CVE-2023-45372 | 5.3 | Oct 9 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0 |
| CVE-2023-45370 | 5.3 | Oct 9 | An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0 |
| CVE-2023-45364 | 5.3 | Oct 9 | An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1 Affected: 1.36.0 before 1.39.5; 1.40.0 |
| CVE-2023-36674 | 5.3 | Aug 20 | An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1 Affected: before 1.35.11; 1.36.0 before 1.38.7; 1.39.0 before 1.39.4; 1.40.0 |
| CVE-2023-37305 | 5.3 | Jun 30 | An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3 Affected: through 1.39.3 |
| CVE-2023-37301 | 5.3 | Jun 30 | An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3 Affected: through 1.39.3 |
| CVE-2023-37300 | 5.3 | Jun 30 | An issue was discovered in the CheckUserLog API in the CheckUser extension for MediaWiki through 1.39.3 Affected: through 1.39.3 |
| CVE-2023-29140 | 5.3 | Mar 31 | An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3 Affected: through 1.39.3 |
| CVE-2022-39193 | 5.3 | Jan 20 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x Affected: 1.39.0; 1.39.0; 1.39.0; 1.39.1 |
| CVE-2023-22912 | 5.3 | Jan 20 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1 Affected: before 1.35.9; 1.36.0 before 1.38.5; 1.39.0; 1.39.0; 1.39.0 |
| CVE-2023-22909 | 5.3 | Jan 10 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1 Affected: before 1.35.9; 1.36.0 before 1.38.5; 1.39.0; 1.39.0; 1.39.0 |
| CVE-2022-41767 | 5.3 | Dec 26 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3 Affected: before 1.35.8; 1.36.0 before 1.37.5; 1.38.0 before 1.38.3 |
| CVE-2022-41765 | 5.3 | Dec 26 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3 Affected: before 1.35.8; 1.36.0 before 1.37.5; 1.38.0 before 1.38.3 |
| CVE-2021-44856 | 5.3 | Dec 26 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0; 1.37.0; 1.37.0; 1.37.0 |
| CVE-2021-44854 | 5.3 | Dec 26 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0; 1.37.0; 1.37.0; 1.37.0 |
| CVE-2021-45471 | 5.3 | Dec 24 | In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items Affected: through 1.37 |
| CVE-2021-45038 | 5.3 | Dec 17 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1 |
| CVE-2021-41800 | 5.3 | Oct 11 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time) Affected: before 1.36.2 |
| CVE-2021-31545 | 5.3 | Apr 22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2021-30158 | 5.3 | Apr 6 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2 Affected: before 1.31.12; 1.32.0 before 1.35.2 |
| CVE-2020-35624 | 5.3 | Dec 21 | An issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1 Affected: through 1.35.1 |
| CVE-2020-35480 | 5.3 | Dec 18 | An issue was discovered in MediaWiki before 1.35.1 Affected: before 1.35.1 |
| CVE-2020-35477 | 5.3 | Dec 18 | MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations Affected: before 1.35.1 |
| CVE-2020-25813 | 5.3 | Sep 27 | In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users Affected: before 1.31.10; 1.32.0 before 1.34.4 |
| CVE-2020-10960 | 5.3 | Apr 3 | In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM… Affected: before 1.34.1 |
| CVE-2013-6455 | 5.3 | Jan 28 | The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors related to writing the… Affected: before 1.19.10; 1.20.0 before 1.21.4; 1.22.0 before 1.22.1 |
| CVE-2019-16738 | 5.3 | Sep 26 | In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup Affected: 1.31.0 before 1.31.4; 1.32.0 before 1.32.4; 1.33.0 before 1.33.1 |
| CVE-2019-12467 | 5.3 | Jul 10 | MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3) Affected: before 1.27.6; 1.30.0 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2 |
| CVE-2018-13258 | 5.3 | Oct 4 | Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible Affected: 1.31.0 through 1.31.1 |
| CVE-2014-1686 | 5.3 | Apr 16 | MediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to thumbnail creation Affected: 1.18.0 |
| CVE-2017-0370 | 5.3 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2017-0368 | 5.3 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2017-8812 | 5.3 | Nov 15 | MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject > (greater than) characters via the id attribute of a headline Affected: through 1.27.3; 1.28.0; 1.28.1; 1.28.2; 1.29.0; 1.29.1 |
| CVE-2015-8628 | 5.3 | Mar 23 | The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before… Affected: through 1.23.11; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4; +5 more |