ME
Product
Mediawiki
417
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 20High 63Medium 198Low 3
Watch
Add Mediawiki to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-8857 | 8.8 | Jul 1 | Full RCE using EasyTimeline Extension Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4 |
| CVE-2026-13706 | 8.8 | Jul 1 | UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0 |
| CVE-2021-46147 | 8.8 | Jan 10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1 |
| CVE-2021-41801 | 8.8 | Oct 11 | The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control Affected: before 1.31.16; 1.35.0 before 1.35.4; 1.36.0 before 1.36.2 |
| CVE-2021-36132 | 8.8 | Jul 2 | An issue was discovered in the FileImporter extension in MediaWiki through 1.36 Affected: through 1.36 |
| CVE-2020-29004 | 8.8 | Jan 29 | The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack Affected: through 1.35 |
| CVE-2020-35626 | 8.8 | Dec 21 | An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1 Affected: through 1.35.1 |
| CVE-2020-35625 | 8.8 | Dec 21 | An issue was discovered in the Widgets extension for MediaWiki through 1.35.1 Affected: through 1.35.1 |
| CVE-2019-12466 | 8.8 | Jul 10 | Wikimedia MediaWiki through 1.32.1 allows CSRF Affected: through 1.32.1 |
| CVE-2017-0367 | 8.8 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure Affected: 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2017-0362 | 8.8 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2015-8624 | 8.8 | Mar 23 | The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token… Affected: through 1.23.11; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4; +5 more |
| CVE-2015-8623 | 8.8 | Mar 23 | The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning,… Affected: through 1.23.11; 1.24.0; 1.24.1; 1.24.2; 1.24.3; 1.24.4 |
| CVE-2012-4381 | 8.1 | Feb 8 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obtain cleartext… Affected: before 1.18.5; 1.19.0 before 1.19.2 |
| CVE-2017-0361 | 7.8 | Apr 13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext Affected: 1.23.0 through 1.23.16; 1.27.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2026-13707 | 7.6 | Jul 1 | Session fixation attacks on improperly configured OAuth 1.0a tools Affected: 1.43.0 before 1.43.9; 1.44.0 before 1.44.6; 1.45.0 before 1.45.4; 1.46.0 |
| CVE-2026-58036 | 7.5 | Jul 1 | Users API leaks whether privileged users have their user groups disabled for lack of 2FA Affected: 1.46.0 |
| CVE-2026-34092 | 7.5 | May 11 | Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2 |
| CVE-2026-34091 | 7.5 | May 11 | User localization leaked by AbuseFilter + EventStream Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2 |
| CVE-2026-34088 | 7.5 | May 11 | RecentChanges entries expose suppressed content via generated log page html Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2 |
| CVE-2026-34087 | 7.5 | May 11 | Users API leaks whether privileged users have their user groups disabled for lack of 2FA Affected: before 1.43.7; 1.44.0 before 1.44.4; 1.45.0 before 1.45.2 |
| CVE-2024-40597 | 7.5 | Jul 7 | An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1 Affected: through 1.42.1 |
| CVE-2024-34506 | 7.5 | May 5 | An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1 Affected: before 1.39.7; 1.40.0 before 1.40.3; 1.41.0 before 1.41.1 |
| CVE-2023-45371 | 7.5 | Oct 9 | An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0 |
| CVE-2023-45363 | 7.5 | Oct 9 | An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1 Affected: before 1.35.12; 1.36.0 before 1.39.5; 1.40.0 |
| CVE-2022-28204 | 7.5 | Sep 19 | A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2 Affected: 1.37.0 before 1.37.2 |
| CVE-2022-28203 | 7.5 | Sep 19 | A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2 Affected: before 1.35.6; 1.36.0 before 1.36.4; 1.37.0 before 1.37.2 |
| CVE-2022-34750 | 7.5 | Jun 28 | An issue was discovered in MediaWiki through 1.38.1 Affected: through 1.38.1 |
| CVE-2022-28323 | 7.5 | Apr 30 | An issue was discovered in MediaWiki through 1.37.2 Affected: through 1.37.2 |
| CVE-2017-0371 | 7.5 | Feb 18 | MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a… Affected: before 1.23.16; 1.24.0 before 1.27.2; 1.28.0 before 1.28.1 |
| CVE-2021-46149 | 7.5 | Jan 10 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1 |
| CVE-2021-44858 | 7.5 | Dec 20 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 Affected: before 1.35.5; 1.36.0 before 1.36.3; 1.37.0 before 1.37.1 |
| CVE-2021-41799 | 7.5 | Oct 11 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time) Affected: before 1.36.2 |
| CVE-2021-42040 | 7.5 | Oct 6 | An issue was discovered in MediaWiki through 1.36.2 Affected: through 1.36.2 |
| CVE-2021-36125 | 7.5 | Jul 2 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36 Affected: through 1.36 |
| CVE-2021-35197 | 7.5 | Jul 2 | In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access Affected: before 1.31.15; 1.32.0 before 1.35.3; 1.36.0 before 1.36.1 |
| CVE-2021-31555 | 7.5 | Apr 22 | An issue was discovered in the Oauth extension for MediaWiki through 1.35.2 Affected: through 1.35.2 |
| CVE-2020-29005 | 7.5 | Jan 29 | The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosure Affected: through 1.35 |
| CVE-2020-35623 | 7.5 | Dec 21 | An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1 Affected: through 1.35.1 |
| CVE-2020-35475 | 7.5 | Dec 18 | In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML Affected: before 1.35.1 |
| CVE-2020-26121 | 7.5 | Sep 27 | An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4 Affected: before 1.34.4 |
| CVE-2020-25869 | 7.5 | Sep 27 | An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4 Affected: before 1.31.10; 1.32.0 before 1.34.4 |
| CVE-2020-25827 | 7.5 | Sep 27 | An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4 Affected: before 1.31.10; 1.32.0 before 1.34.4 |
| CVE-2020-12051 | 7.5 | Apr 21 | The CentralAuth extension through REL1_34 for MediaWiki allows remote attackers to obtain sensitive hidden account information via an… Affected: All versions, or not specified |
| CVE-2013-4572 | 7.5 | Feb 6 | The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is… Affected: before 1.19.9; 1.20 before 1.20.8; 1.21 before 1.21.3 |
| CVE-2013-1817 | 7.5 | Nov 20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information Affected: before 1.19.4; 1.20.0 before 1.20.3 |
| CVE-2013-1816 | 7.5 | Nov 20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted request Affected: before 1.19.4; 1.20.0 before 1.20.3 |
| CVE-2012-0046 | 7.5 | Oct 29 | mediawiki allows deleted text to be exposed Affected: before 1.17.2; 1.18.0 before 1.18.1 |
| CVE-2019-12474 | 7.5 | Jul 10 | Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak Affected: 1.23.0 before 1.27.6; 1.30.0 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2 |
| CVE-2019-12473 | 7.5 | Jul 10 | Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS Affected: 1.27.0 before 1.27.6; 1.30.0 before 1.30.2; 1.31.0 before 1.31.2; 1.32.0 before 1.32.2 |