Vulnerabilidades de The Wikimedia Foundation
CVEs publicadas que afetam produtos de The Wikimedia Foundation: 112 registro(s), com severidade, exploração e correções.
MediaWiki 34CheckUser 8Mediawiki - Cargo Extension 6Mediawiki - GrowthExperiments Extension 4Mediawiki - CentralAuth Extension 2Mediawiki - Wikilove Extension 2Scribunto 2Vector 2VisualEditor 2Mediawiki - WikiLambda Extension 2OATHAuth 2AbuseFilter 2Mediawiki - CampaignEvents Extension 2MediaWiki - ProofreadPage Extension 2MediaWiki - UploadWizard extension 2Mediawiki - Translate Extension 1MediaWiki CookieConsent extension 1Mediawiki - GlobalWatchlist Extension 1Mediawiki - Lockdown Extension 1Mediawiki - SecurePoll Extension 1Mediawiki - MultiBoilerplate Extensionmaste 1MediaWiki PollNY extension 1Mediawiki - CirrusSearch Extension 1Mediawiki - Wikistories 1MediaWiki WatchAnalytics extension 1Mediawiki - PageTriage Extension 1Mediawiki - Skin:BlueSky 1Mediawiki - FlexDiagrams Extension 1Mediawiki - LastModified Extension 1Mediawiki - ExternalGuidance 1Mediawiki - ImageRating Extension 1MediaWiki QuizGame extension 1Cite 1MediaWiki GlobalBlocking extension 1Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension 1MediaWiki WebAuthn extension 1Mediawiki Foundation - Springboard Extension 1MediaWiki PageForms extension 1Mediawiki-extensions-uploadwizard 1Wikibase 1
CVE-2026-103446
Alta · 7.4
CWE-639 30/09/2026
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
Authorization bypass through User-Controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows Authentication Bypass.
This issue affects MediaWiki WikiLambda extension: 1.46.
CVE-2026-5266
Baixa · 2.3
CWE-200 11/05/2026
Exposure of Sensitive Information em The Wikimedia Foundation Echo
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo.
This vulnerability is associated with program files includes/Api/ApiEchoNotifications.Php.
This issue affects Echo: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34095
Média · 6.1
CWE-668 11/05/2026
action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request
Vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34094
Baixa · 3.8
CWE-668 11/05/2026
Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix
Vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Page/Article.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34093
Média · 5.3
CWE-200 11/05/2026
Special:UserRights allows viewing user rights from private wiki
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34092
Alta · 7.5
CWE-200 11/05/2026
Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This vulnerability is associated with program files includes/Skin/Skin.Php.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34091
Alta · 7.5
CWE-200 11/05/2026
User localization leaked by AbuseFilter + EventStream
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34090
Alta · 7.5
CWE-200 11/05/2026
Suggested investigations: Handle suppressed usernames
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser.
This issue affects CheckUser: from 1.45.0 before 1.45.2.
CVE-2026-34089
Alta · 7.5
CWE-401 11/05/2026
Memory leak in Scribunto causes runJobs.php to run out of memory
Vulnerability in Wikimedia Foundation Scribunto.
This issue affects Scribunto: from 1.45.0 before 1.45.2.
CVE-2026-34088
Alta · 7.5
CWE-200 11/05/2026
RecentChanges entries expose suppressed content via generated log page html
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.
This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34087
Alta · 7.5
CWE-200 11/05/2026
Users API leaks whether privileged users have their user groups disabled for lack of 2FA
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth.
This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-34086
Baixa · 2.1
CWE-20 11/05/2026
AbuseFilter misuses ::userCanBitfield, exposing access-controlled information
Vulnerability in Wikimedia Foundation AbuseFilter.
This issue affects AbuseFilter: from * before 1.43.7, 1.44.4, 1.45.2.
CVE-2026-39936
Média · 6.9
CWE-79 07/04/2026
Stored XSS in Score due to usage of non-reserved data attributes
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Score Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.
CVE-2026-39935
Média · 6.9
CWE-79 07/04/2026
XSS-via-i18n in localised wiki names
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CampaignEvents Extension allows Cross-Site Scripting (XSS). This issue was remediated only on the `master` branch.
CVE-2026-39937
Alta · 8.8
CWE-212 07/04/2026
Global vanishing does not completely remove user email
Improper removal of sensitive information before storage or transfer vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure. The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.
CVE-2026-39934
Média · 6.9
CWE-835 07/04/2026
Growth Experiments ReassignMenteesJob runs as an infinite loop
Loop with unreachable exit condition ('infinite loop') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue was remediated only on the `master` branch.
CVE-2026-39933
Média · 6.9
CWE-79 07/04/2026
Multiple XSS vulnerabilities in GlobalWatchlist
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - GlobalWatchlist Extension allows Cross-Site Scripting (XSS). The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.
CVE-2026-39841
Média · 6.1
CWE-79 07/04/2026
Stored XSS through list fields on Cargo's page values and Special:CargoTables
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
CVE-2026-39840
Média · 6.1
CWE-79 07/04/2026
CSS injection in multiple Cargo display formats
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
CVE-2026-39839
Média · 6.1
CWE-80 07/04/2026
Stored XSS through URLs in Cargo's map format
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
CVE-2026-39838
Média · 6.9
CWE-79 07/04/2026
ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - ProofreadPage Extension allows XSS Targeting Non-Script Elements.
The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.
CVE-2026-39837
Média · 5.4
CWE-80 07/04/2026
Stored XSS through the dynamic table format in Cargo
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
CVE-2026-5762
Média · 5.3
CWE-770 07/04/2026
ReportIncident DiscussionTools integration causes slow requests
Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP DoS.
This issue was remediated only on the `master` branch.
CVE-2026-22711
Média · 6.9
CWE-87 07/04/2026
Stored XSS through system messages in WikiLove
Improper neutralization of alternate XSS syntax vulnerability in The Wikimedia Foundation Mediawiki - Wikilove Extension allows Cross-Site Scripting (XSS).The issue has been remediated on the `master` branch, and in the release branches for MediaWiki versions 1.43, 1.44, and 1.45.
CVE-2025-67484
Crítica · 9.8
CWE-20 02/02/2026
MediaWiki: falha de validação imprópria de entrada no formatador XML da API
Vulnerabilidade no Wikimedia Foundation MediaWiki. Esta vulnerabilidade está associada aos arquivos de programa includes/Api/ApiFormatXml.Php.
Este problema afeta o MediaWiki: de * antes de 1.39.16, 1.43.6, 1.44.3, 1.45.1.