ME
Product
Mediawiki
418
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 63Medium 199Low 3
Watch
Add Mediawiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-42044 | 4.8 | Oct 6 | An issue was discovered in the Mentor dashboard in the GrowthExperiments extension in MediaWiki through 1.36.2 Affected: through 1.36.2 |
| CVE-2021-42042 | 4.8 | Oct 6 | An issue was discovered in SpecialEditGrowthConfig in the GrowthExperiments extension in MediaWiki through 1.36.2 Affected: through 1.36.2 |
| CVE-2021-42048 | 4.8 | Oct 6 | An issue was discovered in the Growth extension in MediaWiki through 1.36.2 Affected: through 1.36.2 |
| CVE-2021-36131 | 4.8 | Jul 2 | An XSS issue was discovered in the SportsTeams extension in MediaWiki through 1.36 Affected: through 1.36 |
| CVE-2021-36130 | 4.8 | Jul 2 | An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36 Affected: through 1.36 |
| CVE-2020-29002 | 4.8 | Nov 24 | includes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS via a qbfind message supplied by an administrator Affected: through 1.35 |
| CVE-2017-0365 | 4.7 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2022-28201 | 4.4 | Sep 19 | An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2 Affected: before 1.35.6; 1.36.0 before 1.36.4; 1.37.0 before 1.37.2 |
| CVE-2026-58517 | 4.3 | Jul 1 | Blocked users can create and edit WikiLambda objects Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4 |
| CVE-2025-67476 | 4.3 | Feb 3 | Importing leaks IP address of importer via EventStreams Affected: 1.44.0 before 1.44.3; 1.45.0 |
| CVE-2024-40603 | 4.3 | Jul 7 | An issue was discovered in the ArticleRatings extension for MediaWiki through 1.42.1 Affected: through 1.42.1 |
| CVE-2024-40598 | 4.3 | Jul 7 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1 Affected: through 1.42.1 |
| CVE-2024-40596 | 4.3 | Jul 7 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1 Affected: through 1.42.1 |
| CVE-2023-45362 | 4.3 | Nov 3 | An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0; 1.40.0 |
| CVE-2023-45369 | 4.3 | Oct 9 | An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0 |
| CVE-2022-41766 | 4.3 | May 29 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3 Affected: before 1.35.8; 1.36.0 before 1.37.5; 1.38.0 before 1.38.3 |
| CVE-2021-30153 | 4.3 | Apr 15 | An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2 Affected: before 1.31.13; 1.32.0 before 1.35.2 |
| CVE-2023-29137 | 4.3 | Mar 31 | An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3 Affected: through 1.39.3 |
| CVE-2023-22945 | 4.3 | Jan 11 | In the GrowthExperiments extension for MediaWiki through 1.39, the growthmanagementorlist API allows blocked users (blocked in ApiManageMentorList) to enroll as mentors or edit… Affected: through 1.39.0 |
| CVE-2022-29905 | 4.3 | Apr 29 | The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:UserBoxes CSRF Affected: through 1.37.2 |
| CVE-2022-29903 | 4.3 | Apr 29 | The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the extension's configuration Affected: through 1.37.2 |
| CVE-2021-36129 | 4.3 | Jul 2 | An issue was discovered in the Translate extension in MediaWiki through 1.36 Affected: through 1.36 |
| CVE-2021-36127 | 4.3 | Jul 2 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36 Affected: through 1.36 |
| CVE-2021-31549 | 4.3 | Apr 22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2021-31547 | 4.3 | Apr 22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2021-31546 | 4.3 | Apr 22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2021-30159 | 4.3 | Apr 9 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2 Affected: before 1.31.12; 1.32.0 before 1.35.2 |
| CVE-2021-30156 | 4.3 | Apr 9 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2 Affected: before 1.31.12; 1.32.0 before 1.35.2 |
| CVE-2021-30155 | 4.3 | Apr 9 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2 Affected: before 1.31.12; 1.32.0 before 1.35.2 |
| CVE-2021-30152 | 4.3 | Apr 9 | An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2 Affected: before 1.31.13; 1.32.0 before 1.35.2 |
| CVE-2020-27621 | 4.3 | Oct 22 | The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address Affected: through 1.35.0 |
| CVE-2018-0503 | 4.3 | Oct 4 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for 'newbie' Affected: 1.31.0 before 1.31.1; 1.27.5; 1.29.3; 1.30.1 |
| CVE-2026-34094 | 3.8 | May 11 | Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2 |
| CVE-2025-61634 | 3.1 | Feb 2 | HTML rest endpoint needs PoolCounter and proper parser cache check Affected: before 1.39.14; 1.39.15 before 1.43.4; 1.43.5 before 1.44.1 |
| CVE-2020-15005 | 3.1 | Jun 24 | In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security… Affected: before 1.31.8; 1.32.0 before 1.33.4; 1.34 before 1.34.2 |
| CVE-2015-8005 | – | Nov 9 | MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 uses the thumbnail ImageMagick command line argument, which allows remote attackers to obtain the… Affected: through 1.23.10; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.25.0; +2 more |
| CVE-2015-8004 | – | Nov 9 | MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not properly restrict access to revisions, which allows remote authenticated users with the… Affected: through 1.23.10; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.25.0; +2 more |
| CVE-2015-8003 | – | Nov 9 | MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not throttle file uploads, which allows remote authenticated users to have unspecified impact via… Affected: through 1.23.10; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.25.0; +2 more |
| CVE-2015-8002 | – | Nov 9 | The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 allows remote authenticated users to cause a denial of service (disk… Affected: through 1.23.10; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.25.0; +2 more |
| CVE-2015-8001 | – | Nov 9 | The chunked upload API (ApiUpload) in MediaWiki before 1.23.11, 1.24.x before 1.24.4, and 1.25.x before 1.25.3 does not restrict the uploaded data to the claimed file size, which… Affected: through 1.23.10; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.25.0; +2 more |
| CVE-2015-6734 | – | Sep 1 | Cross-site scripting (XSS) vulnerability in contrib/cssgen.php in the GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and… Affected: through 1.23.9; 1.24.0; 1.24.1; 1.24.2; 1.25.0; 1.25.1 |
| CVE-2015-6733 | – | Sep 1 | GeSHi, as used in the SyntaxHighlight_GeSHi extension and MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2, allows remote attackers to cause a denial of… Affected: through 1.23.9; 1.24.0; 1.24.1; 1.24.2; 1.25.0; 1.25.1 |
| CVE-2015-6730 | – | Sep 1 | Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web… Affected: through 1.23.9; 1.24.0; 1.24.1; 1.24.2; 1.25.0; 1.25.1 |
| CVE-2015-6729 | – | Sep 1 | Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web… Affected: through 1.23.9; 1.24.0; 1.24.1; 1.24.2; 1.25.0; 1.25.1 |
| CVE-2015-6728 | – | Sep 1 | The ApiBase::getWatchlistUser function in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 does not perform token comparison in constant time, which allows… Affected: through 1.23.9; 1.24.0; 1.24.1; 1.24.2; 1.25.0; 1.25.1 |
| CVE-2015-6727 | – | Sep 1 | The Special:DeletedContributions page in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to determine if an IP is autoblocked via… Affected: through 1.23.9; 1.24.0; 1.24.1; 1.24.2; 1.25.0; 1.25.1 |
| CVE-2013-7444 | – | Sep 1 | The Special:Contributions page in MediaWiki before 1.22.0 allows remote attackers to determine if an IP is autoblocked via the "Change block" text Affected: through 1.22.0 |
| CVE-2015-2942 | – | Apr 13 | MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a… Affected: through 1.19.23; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2015-2941 | – | Apr 13 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary… Affected: through 1.19.23; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |
| CVE-2015-2938 | – | Apr 13 | Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML… Affected: through 1.19.23; 1.20; 1.20.1; 1.20.2; 1.20.3; 1.20.4; +34 more |