This page contains various people that the Wikimedia Security Team would like to give thanks to for responsibly reporting security issues.
If you've previously reported a valid security issue (and had it acknowledged and fixed) to Wikimedia, and would like mentioning on this page, please contact us and provide details.
| Date |
Reporter |
Task/Ticket |
Product |
Description |
CVE |
| 2025-07-03 |
User:SomeRandomDeveloper |
GHSA-p85q-mww9-gwqf |
ShortDescription Extension |
Stored XSS in ShortDescription extension |
CVE-2025-53369 |
| 2025-07-03 |
User:SomeRandomDeveloper |
GHSA-rq6g-6g94-jfr4 |
Citizen Skin |
Stored XSS in Citizen skin |
CVE-2025-53368 |
| 2025-07-03 |
User:SomeRandomDeveloper |
GHSA-prmv-7r8c-794g |
Citizen Skin |
Stored XSS in Citizen skin |
CVE-2025-53370 |
| 2025-06-27 |
User:SomeRandomDeveloper |
GHSA-jfj7-249r-7j2m |
TabberNeue Extension |
Stored XSS in TabberNeue extension |
CVE-2025-53093 |
| 2025-06-23 |
User:XXBlackburnXx |
T397595 |
MediaWiki 1.39.13/1.42.7/1.43.2 |
Autoblocks from global account suppressions are publicly visible |
CVE-2025-6927 |
| 2025-06-20 |
User:Leo768 |
T397524 |
Scribunto Extension |
Improper Access Control in Scribunto extension |
CVE-2025-53501 |
| 2025-06-18 |
User:SomeRandomDeveloper |
T397334 |
MassEditRegex Extension |
Stored XSS in MassEditRegex extension |
CVE-2025-53500 |
| 2025-06-17 |
User:Dreamy_Jazz |
T397196 |
AbuseFilter Extension |
Missing Authorization in abusefiltercheckmatch API AbuseFilter extension |
CVE-2025-53499 |
| 2025-06-17 |
User:Dreamy_Jazz |
T397221 |
AbuseFilter Extension |
Insufficient Logging in AbuseFilter extension |
CVE-2025-53498 |
| 2025-06-15 |
User:SomeRandomDeveloper |
T396946 |
MediaSearch Extension |
Stored XSS in MediaSearch |
CVE-2025-53496 |
| 2025-06-12 |
User:dom_walden |
T396750 |
AbuseFilter Extension |
Missing Authorization in IP Reputation AbuseFilter extension |
CVE-2025-53495 |
| 2025-06-12 |
User:SomeRandomDeveloper |
T396685 |
Vector Skin |
Stored XSS through system messages in Vector skin |
CVE-2025-6596 |
| 2025-06-12 |
User:SomeRandomDeveloper |
GHSA-86xf-2mgp-gv3g |
Citizen Skin |
Stored XSS in Citizen skin |
CVE-2025-49576 |
| 2025-06-12 |
User:SomeRandomDeveloper |
GHSA-jwr7-992g-68mh |
Citizen Skin |
Stored XSS in Citizen skin |
CVE-2025-49577 |
| 2025-06-12 |
User:SomeRandomDeveloper |
GHSA-2v3v-3whp-953h |
Citizen Skin |
Stored XSS in Citizen skin |
CVE-2025-49578 |
| 2025-06-12 |
User:SomeRandomDeveloper |
GHSA-g3cp-pq72-hjpv |
Citizen Skin |
Stored XSS in Citizen skin |
CVE-2025-49579 |
| 2025-06-11 |
User:SomeRandomDeveloper |
GHSA-4c2h-67qq-vm87 |
Citizen Skin |
Stored XSS in Citizen skin |
CVE-2025-49575 |
| 2025-06-09 |
User:SomeRandomDeveloper |
T396413 |
RelatedArticles Extension |
Stored XSS in RelatedArticles |
CVE-2025-53497 |
| 2025-06-09 |
User:SomeRandomDeveloper |
T396524 |
WikiHiero Extension |
Stored XSS in WikiHiero |
CVE-2025-53488 |
| 2025-06-06 |
User:AAlhazwani-WMF |
T396230 |
MediaWiki 1.39.13/1.42.7/1.43.2 |
Information leak via email sent to unverified email addresses |
CVE-2025-6593 |
| 2025-06-03 |
User:SomeRandomDeveloper |
T395949 |
GoogleDocs4MW Extension |
XSS in GoogleDocs4MW extension |
CVE-2025-53489 |
| 2025-05-31 |
User:Daimona |
T395622 |
CampaignEvents Extension |
Several XSS in CampaignEvents extension |
CVE-2025-53490 |
| 2025-05-31 |
User:SomeRandomDeveloper |
T395737 |
MintyDocs Extension |
Stored XSS in MintyDocs extension |
CVE-2025-53492 |
| 2025-05-27 |
User:SomeRandomDeveloper |
T395376 |
MintyDocs Extension |
Stored XSS in MintyDocs extension |
CVE-2025-53493 |
| 2025-05-24 |
User:Speedios999 |
T395195 |
Wikimedia Donations Interface / Payment Provider Vendor |
An open-redirect was found via the web gateway for Wikimedia's donation payment |
N/A |
| 2025-05-22 |
User:SomeRandomDeveloper |
T395063 |
MediaWiki 1.39.13/1.42.7/1.43.2 |
XSS in Special:ApiSandbox |
CVE-2025-6594 |
| 2025-05-21 |
User:SomeRandomDeveloper |
T394864 |
MsUpload Extension |
Stored XSS in MsUpload extension |
CVE-2025-7362 |
| 2025-05-21 |
User:SomeRandomDeveloper |
T394938 |
TwoColConflict Extension |
Stored XSS in TwoColConflict extension |
CVE-2025-53494 |
| 2025-05-21 |
User:SomeRandomDeveloper |
T394869 |
UrlShortener Extension |
Stored XSS in UrlShortener extension |
CVE-2025-7056 |
| 2025-05-20 |
User:SomeRandomDeveloper |
T394863 |
MultimediaViewer Extension |
Stored XSS through system messages in MultimediaViewer extension |
CVE-2025-6595 |
| 2025-05-19 |
User:SomeRandomDeveloper |
T394721 |
TitleIcon Extension |
XSS in TitleIcon extension |
CVE-2025-7363 |
| 2025-05-19 |
User:Dreamy_Jazz |
T394692 |
CheckUser Extension |
Several XSS in CheckUser extension |
CVE-2025-53478 |
| 2025-05-19 |
User:Dreamy_Jazz |
T394693 |
CheckUser Extension |
XSS in CheckUser extension |
CVE-2025-53479 |
| 2025-05-19 |
User:Dreamy_Jazz |
T394700 |
CheckUser Extension |
XSS in CheckUser extension |
CVE-2025-53480 |
| 2025-05-18 |
User:SomeRandomDeveloper |
T394612 |
Quiz Extension |
Stored XSS in Quiz extension |
CVE-2025-7057 |
| 2025-05-17 |
User:SomeRandomDeveloper |
T394590 |
WikiCategoryTagCloud Extension |
XSS in WikiCategoryTagCloud extension |
CVE-2025-53486 |
| 2025-05-15 |
User:SomeRandomDeveloper |
T394383 |
ApprovedRevs Extension |
Stored XSS in ApprovedRevs extension |
CVE-2025-53487 |
| 2025-05-15 |
User:Dreamy_Jazz |
T394393 |
IPInfo Extension |
Several XSS in IPInfo extension |
CVE-2025-53482 |
| 2025-05-15 |
User:Dreamy_Jazz |
T394397 |
FlaggedRevs Extension |
XSS in FlaggedRevs extension |
CVE-2025-53491 |
| 2025-04-30 |
User:kostajh |
T392976 |
IPInfo Extension |
Denial of service vector on ipinfo/v0/norevision |
CVE-2025-53481 |
| 2025-04-26 |
User:Dylsss |
T392746 |
MediaWiki 1.39.13/1.42.7/1.43.2 |
Content leak of private wikis due to PasswordReset Wikitext injection in error message |
CVE-2025-6590 |
| 2025-04-24 |
User:Universal-Omega |
GHSA-859x-46h8-vcrv |
ManageWiki Extension |
Self-XSS in ManageWiki extension |
CVE-2025-43861 |
| 2025-04-21 |
User:Universal-Omega |
GHSA-ccrf-x5rp-gppr |
ManageWiki Extension |
Permission bypass in ManageWiki extension |
CVE-2025-32964 |
| 2025-04-20 |
User:BlankEclair |
GHSA-gg42-cv66-f5x7 |
ManageWiki Extension |
SQL injection in ManageWiki extension |
CVE-2025-32956 |
| 2025-04-20 |
User:BlankEclair |
T392341 |
SecurePoll Extension |
CSRF in SecurePoll extension |
CVE-2025-53483 |
| 2025-04-20 |
User:BlankEclair |
T392341 |
SecurePoll Extension |
XSS in SecurePoll extension |
CVE-2025-53484 |
| 2025-04-20 |
User:BlankEclair |
T392341 |
SecurePoll Extension |
Authentication bypass in SecurePoll extension |
CVE-2025-53485 |
| 2025-04-18 |
User:Legoktm |
T392279 |
FeaturedFeeds Extension |
HTML injection in FeaturedFeeds extension |
CVE-2025-53502 |
| 2025-04-18 |
User:Legoktm |
T392276 |
MediaWiki 1.39.13/1.42.7/1.43.2 |
HTML injection in API action=feedcontributions output from i18n message |
CVE-2025-6591 |
| 2025-04-08 |
User:Dreamy_Jazz |
T391343 |
MediaWiki 1.39.13/1.42.7/1.43.2 |
A user who is suppressed via a MultiBlock can see the hidden username in the BlockList |
CVE-2025-6589 |
| 2025-04-06 |
User:suffusion_of_yellow |
T391218 |
MediaWiki 1.39.13/1.42.7/1.43.2 |
Information leak in creating a permanent account from a temporary account |
CVE-2025-6592 |
| 2025-03-16 |
User:Tgr |
T389009 |
MediaWiki 1.39.13/1.42.7/1.43.2 |
MediaWiki treats account autocreation as a login, allowing to bypass reauthentication and perform sensitive actions |
CVE-2025-6597 |
| 2025-03-16 |
User:Tgr |
T389010 |
MediaWiki 1.39.13/1.42.7/1.43.2 |
MediaWiki treats SUL3 local login as security reauthentication, allowing central session to bypass security checks and perform sensitive actions |
CVE-2025-6926 |
| 2025-02-12 |
User:Lucas_Werkmeister_WMDE |
T386175 |
MediaWiki 1.39.13/1.42.7/1.43.2 |
HTML injection in feed output from i18n message |
CVE-2025-32072 |
| 2025-01-07 |
User:BlankEclair |
T13063 |
Medik Extension |
Low-severity stored XSSes for config variables and system messages |
N/A |
| 2024-12-12 |
User:BlankEclair |
T382043 |
BreadCrumbs2 Extension |
XSS when outputting display title |
CVE-2025-23078 |
| 2024-12-09 |
User:BlankEclair |
T381753 |
ArticleFeedbackv5 Extension |
Various stored XSSes |
CVE-2025-23079 |
| 2024-12-01 |
User:BlankEclair |
T381220 |
OpenBadges Extension |
XSSes in Special:BadgeView |
CVE-2025-23080 |
| 2024-11-13 |
User:BlankEclair |
T379749 |
DataTransfer Extension |
Various stored XSSes from system messages, missing CSRF protection |
CVE-2025-23081 |
| 2024-11-03 |
User:BlankEclair |
T378885 |
RefreshSpecial Extension |
Various stored XSSes from system messages in Special:RefreshSpecial |
CVE-2025-23072 |
| 2024-10-04 |
User:BlankEclair |
T12702 |
IncidentReporting Extension |
Various stored XSSes in Special:IncidentReports |
CVE-2024-47815 |
| 2024-10-04 |
User:BlankEclair |
T12701 |
ImportDump Extension |
Users can impersonate import requesters if their actor IDs coincide |
CVE-2024-47816 |
| 2024-10-04 |
User:BlankEclair |
T12698 |
ImportDump Extension |
Stored XSS in Special:RequestImportQueue when displaying timestamp |
CVE-2024-47812 |
| 2024-10-04 |
User:BlankEclair |
T12697 |
WikiDiscover Extension |
Stored XSS in Special:WikiDiscover when displaying wiki information |
CVE-2024-47782 |
| 2024-10-04 |
User:BlankEclair |
T12693 |
CreateWiki Extension |
Stored XSS in Special:RequestWikiQueue when displaying sitename |
CVE-2024-47781 |
| 2024-10-01 |
User:BlankEclair |
T12670 |
DataDump Extension |
Stored XSS in Special:DataDump when outputting dump status |
CVE-2024-47612 |
| 2024-08-11 |
User:BlankEclair |
T372211 |
Cargo Extension |
Various stored, reflective, and DOM-based XSSes |
CVE-2024-47847 |
| 2024-08-11 |
User:BlankEclair |
T372209 |
Cargo Extension |
No CSRF protection |
CVE-2024-47846 |
| 2024-07-22 |
User:BlankEclair |
T370632 |
Cargo Extension |
Users can call arbitrary SQL functions |
CVE-2024-47849 |
| 2024-07-08 |
User:BlankEclair |
T369486 |
CSS Extension |
Path traversal when loading stylesheets |
CVE-2024-47841 |
| 2024-07-08 |
User:BlankEclair |
T368594 |
CSS Extension |
Extension:CSS uses CSS sanitizer incorrectly, and is easily bypassed |
CVE-2024-47845 |
| 2024-10-14 |
Mic1337bie |
T377168 |
codesearch.wmcloud.org |
codesearch.wmcloud.org allowed for XSS via improperly-sanitized input data |
N/A |
| 2024-06-13 |
Chocapikk1337 |
T365644 |
svgtranslate tool |
svgtranslate allowed for remote code execution via improperly-sanitized input data |
N/A |
| 2023-02-20 |
Majid Alqabandi |
T330086 |
OATHAuth Extension |
OATHAuth allows replay attacks when configured without ObjectCache |
CVE-2023-29142 |
| 2022-10-14 |
Sheldon Menezes |
T320785 |
MediaWiki Core |
XSS in Special:Search |
None, never released |
| 2021-10-17 |
Aidil Arief |
T293589 |
VisualEditor Extension |
Blind Stored XSS via Upload Image URL |
CVE-2021-44855 |
| 2021-10-16 |
Aidil Arief |
T293556 |
WikibaseMediaInfo extension |
Stored XSS via WikibaseMediaInfo caption fields at commons.wikimedia.org |
CVE-2021-46146 |
| 2021-01-14 |
surg4bij4k |
T272082 |
Jetty as bundled with archiva |
Reflected XSS on archiva.wikimedia.org |
CVE-2019-10241 |
| November 2017 |
Abdullah Hussam |
T128209 |
MediaWiki 1.29.2, 1.28.3 and 1.27.4 |
api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability. |
CVE-2017-8809 |
| November 2017 |
User:Anomie |
T165846 |
MediaWiki 1.29.2, 1.28.3 and 1.27.4 |
No CVE documented. Please consult Phab for more info. |
none |
| November 2017 |
User:Matma Rex |
T134100 |
MediaWiki 1.29.2, 1.28.3 and 1.27.4 |
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provides different error messages for failed login attempts depending on whether the username exists, which allows remote attackers to enumerate account names and conduct brute-force attacks via a series of requests. |
CVE-2017-8810 |
| November 2017 |
User:Bawolff |
T178451 |
MediaWiki 1.29.2, 1.28.3 and 1.27.4 |
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has XSS when the $wgShowExceptionDetails setting is false and the browser sends non-standard URL escaping. |
CVE-2017-8808 |
| November 2017 |
User:Bastenbas |
T176247 |
MediaWiki 1.29.2, 1.28.3 and 1.27.4 |
The implementation of raw message parameter expansion in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows HTML mangling attacks. |
CVE-2017-8811 |
| November 2017 |
User:Bawolff |
T125163 |
MediaWiki 1.29.2, 1.28.3 and 1.27.4 |
MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows remote attackers to inject > (greater than) characters via the id attribute of a headline. |
CVE-2017-8812 |
| November 2017 |
User:Bawolff |
T124404 |
MediaWiki 1.29.2, 1.28.3 and 1.27.4 |
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk." |
CVE-2017-8814 |
| November 2017 |
User:Bawolff |
T119158 |
MediaWiki 1.29.2, 1.28.3 and 1.27.4 |
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules. |
CVE-2017-8815 |
| November 2017 |
User:Anomie |
T180488 |
MediaWiki 1.29.2, 1.28.3 and 1.27.4 |
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext. |
CVE-2017-0361 |
| November 2017 |
Tom Hutchison |
T180231 |
MediaWiki 1.29.2, 1.28.3 and 1.27.4 |
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "
| CVE-2017-9841 |
| April 2017 |
User:Valhallasw |
T109140 |
MediaWiki 1.28.1, 1.27.2 and 1.23.16 |
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites. |
CVE-2017-0363 |
| April 2017 |
User:Bawolff |
T122209 |
MediaWiki 1.28.1, 1.27.2 and 1.23.16 |
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link. |
CVE-2017-0364 |
| April 2017 |
User:Bawolff |
T144845 |
MediaWiki 1.28.1, 1.27.2 and 1.23.16 |
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations. |
CVE-2017-0365 |
| April 2017 |
User:Tgr |
T125177 |
MediaWiki 1.28.1, 1.27.2 and 1.23.16 |
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext. |
CVE-2017-0361 |
| April 2017 |
User:Legoktm |
T150044 |
MediaWiki 1.28.1, 1.27.2 and 1.23.16 |
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token. |
CVE-2017-0362 |
| April 2017 |
User:Bawolff |
T156184 |
MediaWiki 1.28.1, 1.27.2 and 1.23.16 |
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages. |
CVE-2017-0368 |
| April 2017 |
User:Cassiogomes11 |
T151735 |
MediaWiki 1.28.1, 1.27.2 and 1.23.16 |
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration. |
CVE-2017-0366 |
| April 2017 |
User:MZMcBride |
T48143 |
MediaWiki 1.28.1, 1.27.2 and 1.23.16 |
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter. |
CVE-2017-0370 |
| April 2017 |
User:Luke081515 |
T108138 |
MediaWiki 1.28.1, 1.27.2 and 1.23.16 |
Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it. |
CVE-2017-0369 |
| April 2017 |
User:Bawolff |
T161453 |
MediaWiki 1.28.1, 1.27.2 and 1.23.16 |
Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is insecure. |
CVE-2017-0367 |
| April 2017 |
Yorick Koster (Securify) |
T158689 |
MediaWiki 1.28.1, 1.27.2 and 1.23.16 |
Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities. |
CVE-2017-0372 |
| August 2016 |
User:This, that and the other |
T139565, T139570 |
MediaWiki 1.27.1, 1.26.4, 1.23.15 |
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 does not generate head items in the context of a given title, which allows remote attackers to obtain sensitive information via a parse action to api.php. |
CVE-2016-6335 |
| August 2016 |
User:Bawolff |
T137264 |
MediaWiki 1.27.1, 1.26.4, 1.23.15 |
Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via vectors involving replacement of percent encoding in unclosed internal links. |
CVE-2016-6334 |
| August 2016 |
User:Bawolff |
T133147 |
MediaWiki 1.27.1, 1.26.4, 1.23.15 |
Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css. |
CVE-2016-6333 |
| August 2016 |
User:Bawolff |
T132926 |
MediaWiki 1.27.1, 1.26.4, 1.23.15 |
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by using Special:Undelete. |
CVE-2016-6336 |
| August 2016 |
User:Multichill |
T129738 |
MediaWiki 1.27.1, 1.26.4, 1.23.15 |
MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, might allow remote attackers to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked. |
CVE-2016-6332 |
| August 2016 |
User:Church of emacs |
T115333 |
MediaWiki 1.27.1, 1.26.4, 1.23.15 |
ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php. |
CVE-2016-6331 |
| August 2016 |
User:PleaseStand |
T57548 |
MediaWiki 1.27.1, 1.26.4, 1.23.15 |
No CVE documented. Please consult Phab for more info. |
none |
| August 2016 |
User:Anomie |
T139670 |
MediaWiki 1.27.1, 1.26.4, 1.23.15 |
MediaWiki 1.27.x before 1.27.1 might allow remote attackers to bypass intended session access restrictions by leveraging a call to the UserGetRights function after Session::getAllowedUserRights. |
CVE-2016-6337 |
| May 2016 |
User:Unicornisaurous |
T122056 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:Bawolff |
T127114 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:MaxSem |
T123653 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:Bawolff |
T123071 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:eranroz |
T129506 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:Matiia |
T125283 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:Fomafix |
T103239 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:CSteipp (WMF) |
T122807 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:MaxSem |
T130947 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:Ori Livneh |
T133507 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:Bawolff |
T110143 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:Anomie |
T132874 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:PleaseStand |
T127420 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:CSteipp (WMF) |
T126685 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| May 2016 |
User:CSteipp (WMF) |
T116030 |
MediaWiki 1.26.3, 1.25.6 and 1.23.14 |
No CVE documented. Please consult Phab for more info. |
none |
| Dec 2015 |
User:Xavier Combelle |
T109724 |
MediaWiki 1.26.1, 1.25.4, 1.24.5 and 1.23.12 |
The (1) Special:MyPage, (2) Special:MyTalk, (3) Special:MyContributions, (4) Special:MyUploads, and (5) Special:AllMyUploads pages in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 allow remote attackers to obtain sensitive user login information via crafted links combined with page view statistics. |
CVE-2015-8628 |
| Dec 2015 |
User:Vituzzu |
T97897 |
MediaWiki 1.26.1, 1.25.4, 1.24.5 and 1.23.12 |
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly normalize IP addresses containing zero-padded octets, which might allow remote attackers to bypass intended access restrictions by using an IP address that was not supposed to have been allowed. |
CVE-2015-8627 |
| Dec 2015 |
Frank R. Farmer |
T115522 |
MediaWiki 1.26.1, 1.25.4, 1.24.5 and 1.23.12 |
The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote attackers to obtain access via a brute-force attack. |
CVE-2015-8626 |
| Dec 2015 |
User:Catrope |
T118032 |
MediaWiki 1.26.1, 1.25.4, 1.24.5 and 1.23.12 |
MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters. |
CVE-2015-8625 |
| Dec 2015 |
User:Anomie |
gerrit:156336 |
MediaWiki 1.26.1, 1.25.4, 1.24.5 and 1.23.12 |
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12 and 1.24.x before 1.24.5 does not perform token comparison in constant time before returning, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8624. |
CVE-2015-8623 |
| Dec 2015 |
User:Tgr (WMF) |
T119309 |
MediaWiki 1.26.1, 1.25.4, 1.24.5 and 1.23.12 |
The User::matchEditToken function in includes/User.php in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which allows remote attackers to guess the edit token and bypass CSRF protection via a timing attack, a different vulnerability than CVE-2015-8623. |
CVE-2015-8624 |
| Dec 2015 |
User:Matma Rex |
T117899 |
MediaWiki 1.26.1, 1.25.4, 1.24.5 and 1.23.12 |
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as demonstrated by a wikilink to a page named "javascript:alert('XSS!')." |
CVE-2015-8622 |