Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how wikimedia foundation compares to other vendors in security performance

View Risk Score →

Software

wikimedia foundation mediawiki
53
wikimedia foundation checkuser
9
wikimedia foundation mediawiki - wikilambda extension
5
wikimedia foundation mediawiki centralauth extension
4
wikimedia foundation abusefilter
3
wikimedia foundation mediawiki - cargo extension
3
wikimedia foundation mediawiki cargo extension
3
wikimedia foundation wikipedia android app
3
wikimedia foundation mediawiki - campaignevents extension
2
wikimedia foundation mediawiki - centralauth extension
2
wikimedia foundation mediawiki - growth experiments extension
2
wikimedia foundation mediawiki - uploadwizard extension
2
wikimedia foundation mediawiki templatesandbox extension
2
wikimedia foundation mediawiki wikibase extension
2
wikimedia foundation oathauth
2
wikimedia foundation scribunto
2
wikimedia foundation vector
2
wikimedia foundation visualeditor
2
wikimedia foundation wikibase extension
2
wikimedia foundation campaignevents extension
1
wikimedia foundation centralauth
1
wikimedia foundation cite
1
wikimedia foundation confirmedit
1
wikimedia foundation discussiontools
1
wikimedia foundation echo
1
wikimedia foundation luasandbox
1
wikimedia foundation mediawiki - advancedsearch extension
1
wikimedia foundation mediawiki - ajax poll extension
1
wikimedia foundation mediawiki - charts extension
1
wikimedia foundation mediawiki - cirrussearch extension
1
wikimedia foundation mediawiki - confirm account extension
1
wikimedia foundation mediawiki - css extension
1
wikimedia foundation mediawiki - eventbus extension
1
wikimedia foundation mediawiki - externalguidance
1
wikimedia foundation mediawiki - flexdiagrams extension
1
wikimedia foundation mediawiki - flow extension
1
wikimedia foundation mediawiki - growthexperiments extension
1
wikimedia foundation mediawiki - imagerating extension
1
wikimedia foundation mediawiki - languageselector extension
1
wikimedia foundation mediawiki - lastmodified extension
1
wikimedia foundation mediawiki - multiboilerplate extension
1
wikimedia foundation mediawiki - oauth extension
1
wikimedia foundation mediawiki - pagetriage extension
1
wikimedia foundation mediawiki - proofreadpage extension
1
wikimedia foundation mediawiki - quiz extension
1
wikimedia foundation mediawiki - skin:bluesky
1
wikimedia foundation mediawiki - thanks extension
1
wikimedia foundation mediawiki - translate extension
1
wikimedia foundation mediawiki - urlshortener extension
1
wikimedia foundation mediawiki - visualdata extension
1

Wikimedia Foundation MediaWiki - Lockdown ExtensionThe compare API module breaks Extension:Lockdown

Risk 87
Severity
10
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.

First published (updated )
CVE-2025-12004

Wikimedia Foundation MediaWiki ExternalData ExtensionUnauthenticated remote code execution through wikitext in ExternalData

Risk 87
Severity
10
OS Command Injection, Command Injection
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Wikimedia Foundation Mediawiki - ExternalData Extension allows OS Command Injection.

This issue affects Mediawiki - ExternalData Extension: from before 3.7.

First published (updated )
CVE-2026-100382

Wikimedia Foundation MediaWiki EasyTimeline extensionEasyTimeline should not serve image maps as application/xml

Risk 86
Severity
9.8
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

XML injection (aka blind XPath injection) vulnerability in The Wikimedia Foundation Mediawiki - EasyTimeline extension allows XML Injection.

This issue affects Mediawiki - EasyTimeline extension: before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-103044

Wikimedia Foundation MediaWiki - AbuseFilter ExtensionUnauthorized Disclosure of IP Reputation in AbuseFilter

Risk 66
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.

First published (updated )
CVE-2025-53495

Wikimedia Foundation MediaWiki - AbuseFilter ExtensionUnauthorized Inspection of Protected Variables in AbuseFilter

Risk 66
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.43.X before 1.43.2.

First published (updated )
CVE-2025-53499

Wikimedia Foundation MediaWiki TemplateSandbox ExtensionTemplateSandbox does not check read permissions for the page being previewed

Risk 66
Severity
9.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs.

This issue affects Mediawiki - TemplateSandbox Extension: from before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-100240

Wikimedia Foundation Mediawiki - Scribunto ExtensionContent Access Bypass in Scribunto

Risk 77
Severity
8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Authorization.This issue affects Mediawiki - Scribunto Extension: from 1.39.X before 1.39.12, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

First published (updated )
CVE-2025-53501

Wikimedia Foundation Mediawiki - CentralAuth ExtensionSecurity Authentication Bypass in CentralAuth

Risk 56
Severity
8.8
EPSS
0.11%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

First published (updated )
CVE-2025-6926

Wikimedia Foundation Mediawiki - LanguageSelector ExtensionImproperly sanitized style parameter in LanguageSelector

Risk 65
Severity
8.8
Code Injection
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - LanguageSelector Extension allows Code Injection.This issue affects Mediawiki - LanguageSelector Extension: from master before 1.39.

First published (updated )
CVE-2025-62697

Wikimedia Foundation MediaWiki CentralAuth ExtensionGlobal vanishing does not completely remove user email

Risk 65
Severity
8.8
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the master branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.

First published (updated )
CVE-2026-39937

Wikimedia Foundation WikipediaWikipedia 12.0 Denial of Service via Search

Risk 47
Severity
8.7
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash.

First published (updated )
CVE-2018-25246

Wikimedia Foundation Mediawiki - IPInfo ExtensionDenial of service vector on ipinfo/v0/norevision

Risk 43
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Excessive Allocation.This issue affects Mediawiki - IPInfo Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

First published (updated )
CVE-2025-53481

Wikimedia Foundation MediaWiki WatchAnalyticsSQL injection in WatchAnalytics through Special:ClearPendingReviews

Risk 68
Severity
7.5
SQL Injection
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extension allows SQL Injection.This issue affects MediaWiki WatchAnalytics extension: 1.43, 1.44.

First published (updated )
CVE-2025-62658

Wikimedia Foundation MediaWiki - CSS extensionPath Traversal vulnerability in CSS extension on certain web servers

Risk 31
Severity
7.5
EPSS
0.06%
Path Traversal
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Wikimedia Foundation MediaWiki - CSS extension allows Path Traversal.This issue affects MediaWiki - CSS extension: 1.44, 1.43, 1.39.

First published (updated )
CVE-2026-0669

Wikimedia Foundation MediaWiki - EventBus ExtensionPrivate change tags exposed to anonymous users via revision-tags-change events

Risk 43
Severity
7.5
Infoleak
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - EventBus Extension allows Excavation.

This issue affects Mediawiki - EventBus Extension: 1.47.0-alpha.

First published (updated )
CVE-2026-100241

Wikimedia Foundation MediaWiki DataTransfer ExtensionDataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)

Risk 43
Severity
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Dependency on Vulnerable Third-Party Component and Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Excessive Allocation.

This issue affects Mediawiki - DataTransfer Extension: from 1.46.0 before 1.47.0.

First published (updated )
CVE-2026-100242

Wikimedia Foundation MediaWiki CentralAuth ExtensionCentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

Risk 43
Severity
7.5
Infoleak
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation.

This issue affects Mediawiki - CentralAuth Extension: from before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-100244

Wikimedia Foundation MediaWiki UserPageViewTracker ExtensionUnauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters

Risk 43
Severity
7.5
SQL Injection
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection.

This issue affects Mediawiki - UserPageViewTracker Extension: from before 1.46.1, 1.45.5, 1.43.10.

First published (updated )
CVE-2026-102796

Wikimedia Foundation MediaWiki WikiLambda extensionWikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments

Risk 64
Severity
7.4
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.

This issue affects MediaWiki WikiLambda extension: 1.46.

First published (updated )
CVE-2026-103446

Wikimedia Foundation MediaWiki Wikibase ExtensionUnauthenticated arbitrary file deletion through Wikibase serialized entity parsing

Risk 58
Severity
7.2
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:I/V:C/RE:M/U:Red

Deserialization of untrusted data vulnerability in The Wikimedia Foundation MediaWiki Wikibase extension allows Leverage Executable Code in Non-Executable Files.

This issue affects MediaWiki Wikibase extension: 1.46, 1.45, and 1.43.

First published (updated )
CVE-2026-103441

Wikimedia Foundation MediaWiki CentralAuth ExtensionMergeAccount PHP object injection via session-key substitution

Risk 53
Severity
7.2
Code Injection
CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:P/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber

External control of system or configuration setting vulnerability in The Wikimedia Foundation MediaWiki CentralAuth extension allows Code Injection.

This issue affects MediaWiki CentralAuth extension: 1.46, 1.45, and 1.43.

First published (updated )
CVE-2026-103442

Wikimedia Foundation Mediawiki - PageTriageUser can review/unreview articles while blocked

Risk 33
Severity
6.9
Infoleak
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

First published (updated )
CVE-2024-47848

Wikimedia Foundation Mediawiki - Version Compare ExtensionXSSes and potential RCE in Special:VersionCompare

Risk 35
Severity
6.9
EPSS
0.06%
XSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Version Compare Extension: from 1.39 through 1.43.

First published (updated )
CVE-2025-32078

Wikimedia Foundation Mediawiki Core - Feed UtilsHTML injection in feed output from i18n message

Risk 35
Severity
6.9
EPSS
0.06%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43.

First published (updated )
CVE-2025-32072

Wikimedia Foundation Mediawiki - Mobile Frontend ExtensionCross-origin data leak in mobilefrontend via lazy load images

Risk 35
Severity
6.9
EPSS
0.05%
Infoleak
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43.

First published (updated )
CVE-2025-32080

Wikimedia Foundation Mediawiki - Visual Data ExtensionEvil regex used to process user-provided data in VisualData

Risk 35
Severity
6.9
EPSS
0.10%
Input Validation
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Data Extension: from 1.39 through 1.43.

First published (updated )
CVE-2025-32076

Wikimedia Foundation Mediawiki - Tabs ExtensionIP and user agent leaks in Extension:Tabs

Risk 35
Severity
6.9
EPSS
0.10%
Input Validation, Code Injection
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extension: from 1.39 through 1.43.

First published (updated )
CVE-2025-32075

Wikimedia Foundation Mediawiki - Extension:SimpleCalendarXSSes in Extension:SimpleCalendar

Risk 30
Severity
6.9
EPSS
0.10%
Input Validation, XSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Extension:SimpleCalendar: from 1.39 through 1.43.

First published (updated )
CVE-2025-32077

Wikimedia Foundation Mediawiki - Skin:BlueSkyStored XSS through system messages in Skin:BlueSky

Risk 50
Severity
6.9
XSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Skin:BlueSky allows Stored XSS.This issue affects Mediawiki - Skin:BlueSky: from master before 1.39.

First published (updated )
CVE-2025-62665

Wikimedia Foundation Mediawiki - AdvancedSearch ExtensionStored XSS through system messages in AdvancedSearch

Risk 50
Severity
6.9
XSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master before 1.39.

First published (updated )
CVE-2025-62662

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203