Vulnerabilities (CVE)

Filtered by vendor Mediawiki Subscribe
Filtered by product Mediawiki
Total 370 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2015-6729 1 Mediawiki 1 Mediawiki 2025-04-12 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the rel404 parameter, which is not properly handled in an error page.
CVE-2013-4573 1 Mediawiki 1 Mediawiki 2025-04-11 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in the ZeroRatedMobileAccess extension for MediaWiki 1.19.x before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to inject arbitrary web script or HTML via the "to" parameter to index.php.
CVE-2013-4308 2 Liquidthreads Project, Mediawiki 2 Liquidthreads, Mediawiki 2025-04-11 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in pages/TalkpageHistoryView.php in the LiquidThreads (LQT) extension 2.x and possibly 3.x for MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to inject arbitrary web script or HTML via a thread subject.
CVE-2010-1647 1 Mediawiki 1 Mediawiki 2025-04-11 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) strings that are processed as script by Internet Explorer.
CVE-2013-2032 3 Fedoraproject, Gentoo, Mediawiki 3 Fedora, Linux, Mediawiki 2025-04-11 5.0 MEDIUM N/A
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
CVE-2011-1587 2 Mediawiki, Microsoft 2 Mediawiki, Internet Explorer 2025-04-11 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.4, when Internet Explorer 6 or earlier is used, allows remote attackers to inject arbitrary web script or HTML via an uploaded file accessed with a dangerous extension such as .html located before a ? (question mark) in a query string, in conjunction with a modified URI path that has a %2E sequence in place of the . (dot) character. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-1578.
CVE-2010-1648 1 Mediawiki 1 Mediawiki 2025-04-11 6.8 MEDIUM N/A
Cross-site request forgery (CSRF) vulnerability in the login interface in MediaWiki 1.15 before 1.15.4 and 1.16 before 1.16 beta 3 allows remote attackers to hijack the authentication of users for requests that (1) create accounts or (2) reset passwords, related to the Special:Userlogin form.
CVE-2010-1190 1 Mediawiki 1 Mediawiki 2025-04-11 4.3 MEDIUM N/A
thumb.php in MediaWiki before 1.15.2, when used with access-restriction mechanisms such as img_auth.php, does not check user permissions before providing scaled images, which allows remote attackers to bypass intended access restrictions and read private images via unspecified manipulations.
CVE-2011-4360 2 Debian, Mediawiki 2 Debian Linux, Mediawiki 2025-04-11 5.0 MEDIUM N/A
MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter.
CVE-2013-4568 1 Mediawiki 1 Mediawiki 2025-04-11 4.3 MEDIUM N/A
Incomplete blacklist vulnerability in Sanitizer::checkCss in MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain non-ASCII characters in CSS, as demonstrated using variations of "expression" containing (1) full width characters or (2) IPA extensions, which are converted and rendered by Internet Explorer.
CVE-2012-1578 1 Mediawiki 1 Mediawiki 2025-04-11 6.8 MEDIUM N/A
Multiple cross-site request forgery (CSRF) vulnerabilities in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allow remote attackers to hijack the authentication of users with the block permission for requests that (1) block a user via a request to the Block module or (2) unblock a user via a request to the Unblock module.
CVE-2012-4885 1 Mediawiki 1 Mediawiki 2025-04-11 5.0 MEDIUM N/A
The wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to cause a denial of service (infinite loop) via certain input, as demonstrated by the padleft function.
CVE-2013-2114 1 Mediawiki 1 Mediawiki 2025-04-11 6.8 MEDIUM N/A
Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.
CVE-2011-4361 2 Debian, Mediawiki 2 Debian Linux, Mediawiki 2025-04-11 5.0 MEDIUM N/A
MediaWiki before 1.17.1 does not check for read permission before handling action=ajax requests, which allows remote attackers to obtain sensitive information by (1) leveraging the SpecialUpload::ajaxGetExistsWarning function, or by (2) leveraging an extension, as demonstrated by the CategoryTree, ExtTab, and InlineEditor extensions.
CVE-2011-0047 1 Mediawiki 1 Mediawiki 2025-04-11 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.16.2 allows remote attackers to inject arbitrary web script or HTML via crafted Cascading Style Sheets (CSS) comments, aka "CSS injection vulnerability."
CVE-2012-1582 1 Mediawiki 1 Mediawiki 2025-04-11 4.3 MEDIUM N/A
Cross-site scripting (XSS) vulnerability in the wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to inject arbitrary web script or HTML via a crafted page with "forged strip item markers," as demonstrated using the CharInsert extension.
CVE-2012-1581 1 Mediawiki 1 Mediawiki 2025-04-11 5.0 MEDIUM N/A
MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses weak random numbers for password reset tokens, which makes it easier for remote attackers to change the passwords of arbitrary users.
CVE-2013-4306 1 Mediawiki 1 Mediawiki 2025-04-11 6.8 MEDIUM N/A
Cross-site request forgery (CSRF) vulnerability in api/ApiQueryCheckUser.php in the CheckUser extension for MediaWiki, possibly Checkuser before 2.3, allows remote attackers to hijack the authentication of arbitrary users for requests that "perform sensitive write actions" via unspecified vectors.
CVE-2013-4301 1 Mediawiki 1 Mediawiki 2025-04-11 5.0 MEDIUM N/A
includes/resourceloader/ResourceLoaderContext.php in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 allows remote attackers to obtain sensitive information via a "<" (open angle bracket) character in the lang parameter to w/load.php, which reveals the installation path in an error message.
CVE-2010-2789 1 Mediawiki 1 Mediawiki 2025-04-11 6.8 MEDIUM N/A
PHP remote file inclusion vulnerability in MediaWikiParserTest.php in MediaWiki 1.16 beta, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via unspecified vectors.