Skip to content
Noroxi

mediawiki records

466 published records for vendor mediawiki. 0 of them have been exploited in the wild (listed in CISA KEV) and 2 have a ready-made attack tool.

Filter by product ↓

Researcher profile

Entered KEV
0 · 0%
Weaponized
2 · 0.4%
Pre-auth RCE
10
With a fix record
60.5%
Median publish → KEV
No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

  1. 17
  2. 18
  3. 19
  4. 20
  5. 21
  6. 22
  7. 23
  8. 24
  9. 25
  10. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

466 records
  • CVE-2017-0372
    60This week

    Parameters injection in SyntaxHighlight results in multiple vulnerabilities

    CriticalCVSS 9.8WeaponizedEPSS 11%

    mediawiki · mediawikiApr 13, 2018

  • CVE-2022-29904
    44Plan

    The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with cer

    CriticalCVSS 9.8No exploitEPSS 16%

    mediawiki · mediawikiApr 29, 2022

  • CVE-2017-8809
    41Plan

    api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 7%

    mediawiki · mediawikiNov 15, 2017

  • CVE-2014-1610
    40Plan

    MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows rem

    MediumCVSS 6.0WeaponizedEPSS 42%

    mediawiki · mediawikiJan 30, 2014

  • CVE-2019-12468
    40Plan

    An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1.

    CriticalCVSS 9.8No exploitEPSS 3%

    mediawiki · mediawikiJul 10, 2019

  • CVE-2015-8009
    40Plan

    The MWOAuthDataStore::lookup_token function in Extension:OAuth for MediaWiki 1.25.x before 1.25.3, 1.24.x before 1.24.4, and before 1.23.11

    CriticalCVSS 9.8No exploitEPSS 2%

    mediawiki · mediawikiJul 25, 2017

  • CVE-2020-29007
    40Plan

    The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond exe

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    mediawiki · scoreApr 15, 2023

  • CVE-2014-9487
    40Plan

    The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial o

    CriticalCVSS 9.8No exploitEPSS 2%

    mediawiki · mediawikiOct 17, 2017

  • CVE-2015-8626
    40Plan

    The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generate

    CriticalCVSS 9.8No exploitEPSS 1%

    mediawiki · mediawikiMar 23, 2017

  • CVE-2021-31556
    39Monitor

    An issue was discovered in the Oauth extension for MediaWiki through 1.35.2.

    CriticalCVSS 9.8No exploitEPSS 1%

    mediawiki · mediawikiAug 12, 2021

  • CVE-2022-28205
    39Monitor

    An issue was discovered in MediaWiki through 1.37.1.

    CriticalCVSS 9.8No exploitEPSS 1%

    mediawiki · mediawikiMar 30, 2022

  • CVE-2021-36128
    39Monitor

    An issue was discovered in the CentralAuth extension in MediaWiki through 1.36.

    CriticalCVSS 9.8No exploitEPSS 1%

    mediawiki · mediawikiJul 2, 2021

  • CVE-2022-28206
    39Monitor

    An issue was discovered in MediaWiki through 1.37.1.

    CriticalCVSS 9.8No exploitEPSS 1%

    mediawiki · mediawikiMar 30, 2022

  • CVE-2022-28209
    39Monitor

    An issue was discovered in Mediawiki through 1.37.1.

    CriticalCVSS 9.8No exploitEPSS 1%

    mediawiki · mediawikiMar 30, 2022

  • CVE-2022-29906
    39Monitor

    The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check

    CriticalCVSS 9.8No exploitEPSS 1%

    mediawiki · mediawikiApr 29, 2022

  • CVE-2020-10534
    39Monitor

    In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked

    CriticalCVSS 9.8No exploitEPSS 1%

    mediawiki · mediawikiMar 12, 2020

  • CVE-2021-36126
    39Monitor

    An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36.

    CriticalCVSS 9.8No exploitEPSS 1%

    mediawiki · mediawikiJul 2, 2021

  • CVE-2023-29141
    39Monitor

    An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3.

    CriticalCVSS 9.8No exploitEPSS 1%

    mediawiki · mediawikiMar 31, 2023

  • CVE-2023-37303
    39Monitor

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.

    CriticalCVSS 9.8No exploitEPSS 0%

    mediawiki · mediawikiJun 30, 2023

  • CVE-2024-34502
    39Monitor

    An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1.

    CriticalCVSS 9.8No exploitEPSS 0%

    mediawiki · mediawikiMay 5, 2024

  • CVE-2023-45363
    37Monitor

    An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.

    HighCVSS 7.5No exploitEPSS 23%

    mediawiki · mediawikiOct 9, 2023

  • CVE-2017-0367
    36Monitor

    Having LocalisationCache directory default to system tmp directory is insecure

    HighCVSS 8.8No exploitEPSS 1%

    mediawiki · mediawikiApr 13, 2018

  • CVE-2021-41801
    35Monitor

    The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control.

    HighCVSS 8.8No exploitEPSS 1%

    mediawiki · mediawikiOct 11, 2021

  • CVE-2020-35625
    35Monitor

    An issue was discovered in the Widgets extension for MediaWiki through 1.35.1.

    HighCVSS 8.8No exploitEPSS 1%

    mediawiki · mediawikiDec 21, 2020

  • CVE-2021-36132
    35Monitor

    An issue was discovered in the FileImporter extension in MediaWiki through 1.36.

    HighCVSS 8.8No exploitEPSS 1%

    mediawiki · mediawikiJul 2, 2021