CVE-2025-61638
Published Feb 3, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vul…
Vendor archive
wikimedia CVEs
Beta · best-effort13 CVEs tagged to vendor wikimedia — 0 Critical, 0 High, 10 Medium, 2 Low, 1 Unrated.
CVE-2026-0817
Published Jan 9, 2026Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.…
- evidence mentions
- 2
- Buzz score
- 21.0
CVE-2026-22710
Published Jan 9, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Extension allows Cross-S…
- evidence mentions
- 2
- Buzz score
- 21.0
CVE-2026-0671
Published Jan 8, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard extension allows Cross-S…
- evidence mentions
- 2
- Buzz score
- 21.0
CVE-2024-47841
Published Oct 5, 2024Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue…
CVE-2024-47845
Published Oct 5, 2024Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension: fro…
CVE-2024-47840
Published Oct 5, 2024Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This…
CVE-2018-25065
Published Jan 5, 2023A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18nTags_body.php of the…
CVE-2020-36324
Published Apr 21, 2021Wikimedia Quarry analytics-quarry-web before 2020-12-15 allows Reflected XSS because app.py does not explicitly set the application/json content type.
CVE-2021-30458
Published Apr 9, 2021An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta>…
CVE-2019-19329
Published Nov 27, 2019In Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07, when mathematical expressions in results are displayed directly, arbitrary JavaScript execution can occur,…
CVE-2019-19328
Published Nov 27, 2019ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer b…
CVE-2019-19327
Published Nov 27, 2019ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOT…
Showing 1-13 of 13 CVEsPage 1 of 1