ME
Product
Mediawiki
417
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 63Medium 198Low 3
Watch
Add Mediawiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-26120 | 6.1 | Sep 27 | XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway Affected: before 1.34.4 |
| CVE-2020-25828 | 6.1 | Sep 27 | An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4 Affected: 1.32.0 before 1.34.4; 1.31.10 |
| CVE-2020-25815 | 6.1 | Sep 27 | An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4 Affected: 1.32.0 before 1.34.4 |
| CVE-2020-25814 | 6.1 | Sep 27 | In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur Affected: before 1.31.10; 1.32.0 before 1.34.4 |
| CVE-2020-25812 | 6.1 | Sep 27 | An issue was discovered in MediaWiki 1.34.x before 1.34.4 Affected: 1.34.0 before 1.34.4 |
| CVE-2020-10959 | 6.1 | Jun 2 | resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page Affected: before 1.35 |
| CVE-2013-6451 | 6.1 | Jan 28 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arbitrary web script or… Affected: 1.19.9 before 1.19.10; 1.20.0 before 1.21.4; 1.22.0 before 1.22.1 |
| CVE-2020-6163 | 6.1 | Jan 8 | The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySuggestionsWidget template (in the… Affected: 1.35 |
| CVE-2019-19910 | 6.1 | Dec 19 | The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles certain HTML attributes, as demonstrated by IMG onmouseover= (impact is XSS) and IMG… Affected: 1.34; 1.35 |
| CVE-2013-4303 | 6.1 | Dec 11 | includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when… Affected: 1.19.0 before 1.19.8; 1.20.0 before 1.20.7; 1.21.0 before 1.21.2 |
| CVE-2019-19709 | 6.1 | Dec 11 | MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the… Affected: through 1.33.1 |
| CVE-2013-1951 | 6.1 | Oct 31 | A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HTML via Lua function… Affected: before 1.19.5; 1.20.0 before 1.20.4 |
| CVE-2019-12471 | 6.1 | Jul 10 | Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS Affected: 1.30.0 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2 |
| CVE-2017-0364 | 6.1 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2017-0363 | 6.1 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2017-8811 | 6.1 | Nov 15 | The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks Affected: through 1.27.3; 1.28.0; 1.28.1; 1.28.2; 1.29.0; 1.29.1 |
| CVE-2017-8808 | 6.1 | Nov 15 | MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the browser sends non-standard URL escaping Affected: through 1.27.3; 1.28.0; 1.28.1; 1.28.2; 1.29.0; 1.29.1 |
| CVE-2012-4378 | 6.1 | Oct 26 | Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to… Affected: through 1.18.4; 1.19.0; 1.19.1 |
| CVE-2012-4377 | 6.1 | Oct 26 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a… Affected: through 1.18.4; 1.19.0; 1.19.1 |
| CVE-2016-6334 | 6.1 | Apr 20 | Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote… Affected: through 1.23.14; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; +1 more |
| CVE-2016-6333 | 6.1 | Apr 20 | Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote… Affected: through 1.23.14; 1.26.0; 1.26.1; 1.26.2; 1.26.3; 1.26.4; +1 more |
| CVE-2015-8622 | 6.1 | Mar 23 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL,… Affected: through 1.23.11; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4; +5 more |
| CVE-2014-9481 | 5.9 | Jan 27 | The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, related to unstripping… Affected: before 1.19.23; 1.19.24 before 1.22.15; 1.23.0 before 1.23.8; 1.23.9 before 1.24.1 |
| CVE-2026-58026 | 5.7 | Jul 1 | $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0 |
| CVE-2026-58024 | 5.7 | Jul 1 | API identification of users on private wikis Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0 |
| CVE-2022-47927 | 5.5 | Jan 12 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1 Affected: before 1.35.9; 1.36.0 before 1.38.5; 1.39.0; 1.39.0; 1.39.0 |
| CVE-2026-58028 | 5.4 | Jul 1 | Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0 |
| CVE-2026-58031 | 5.4 | Jul 1 | Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected Affected: 1.46.0 |
| CVE-2025-61646 | 5.4 | Feb 3 | Watchlist group mode reveals authors of edits with hidden authorship Affected: before 1.39.14; 1.43.0 before 1.43.4; 1.44.0 |
| CVE-2024-23178 | 5.4 | Jan 12 | An issue was discovered in the Phonos extension in MediaWiki before 1.40.2 Affected: before 1.40.2 |
| CVE-2024-23174 | 5.4 | Jan 12 | An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2 Affected: before 1.35.14; 1.36.0 before 1.39.6; 1.40.0 before 1.40.2 |
| CVE-2024-23172 | 5.4 | Jan 12 | An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2 Affected: before 1.35.14; 1.36.0 before 1.39.6; 1.40.0 before 1.40.2 |
| CVE-2024-23171 | 5.4 | Jan 12 | An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2 Affected: before 1.35.14; 1.36.0 before 1.39.6; 1.40.0 before 1.40.2 |
| CVE-2023-45360 | 5.4 | Nov 3 | An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.39.0 before 1.39.5; 1.40.0; 1.40.0 |
| CVE-2023-37304 | 5.4 | Jun 30 | An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3 Affected: through 1.39.3 |
| CVE-2023-22910 | 5.4 | Jan 20 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1 Affected: before 1.35.9; 1.36.0 before 1.38.5; 1.39.0; 1.39.0; 1.39.0 |
| CVE-2021-44855 | 5.4 | Dec 26 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0; 1.37.0; 1.37.0; 1.37.0 |
| CVE-2021-46146 | 5.4 | Jan 10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1 |
| CVE-2021-42045 | 5.4 | Oct 6 | An issue was discovered in SecurePoll in the Growth extension in MediaWiki through 1.36.2 Affected: through 1.36.2 |
| CVE-2021-42047 | 5.4 | Oct 6 | An issue was discovered in the Growth extension in MediaWiki through 1.36.2 Affected: through 1.36.2 |
| CVE-2021-31554 | 5.4 | Apr 22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2021-31552 | 5.4 | Apr 22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2021-31550 | 5.4 | Apr 22 | An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2020-29003 | 5.4 | Nov 24 | The PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll question, entered during Special:CreatePoll or Special:UpdatePoll Affected: through 1.35 |
| CVE-2020-27957 | 5.4 | Oct 28 | The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data Affected: through 1.35 |
| CVE-2017-0366 | 5.4 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2026-34093 | 5.3 | May 11 | Special:UserRights allows viewing user rights from private wiki Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2 |
| CVE-2024-47913 | 5.3 | Oct 4 | An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2 Affected: before 1.39.9; 1.40.0 before 1.41.3; 1.42.0 before 1.42.2 |
| CVE-2023-45374 | 5.3 | Oct 9 | An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0 |
| CVE-2023-45372 | 5.3 | Oct 9 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0 |