Action not permitted
Modal body text goes here.
Modal Title
Modal Body
WID-SEC-W-2025-1438
Vulnerability from csaf_certbund - Published: 2025-06-30 22:00 - Updated: 2025-07-23 22:00Summary
MediaWiki: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um Code zur Ausführung zu bringen, Informationen offenzulegen und weitere, nicht definierte Auswirkungen zu verursachen.
Betroffene Betriebssysteme
- Linux
- Sonstiges
- UNIX
- Windows
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "MediaWiki ist ein freies Wiki, das urspr\u00fcnglich f\u00fcr den Einsatz auf Wikipedia entwickelt wurde.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um Code zur Ausf\u00fchrung zu bringen, Informationen offenzulegen und weitere, nicht definierte Auswirkungen zu verursachen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- Sonstiges\n- UNIX\n- Windows",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-1438 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-1438.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-1438 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1438"
},
{
"category": "external",
"summary": "MediaWiki Security and maintenance release vom 2025-06-30",
"url": "https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/TT45WDZ7MDTXXBEFLBMLAJI532O2PN2U/"
},
{
"category": "external",
"summary": "MediaWiki 1.44.0 Release Notes vom 2025-07-03",
"url": "https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/C3ZZDKSFH2PW55GRH6Y4SXIM37GBXL32/"
},
{
"category": "external",
"summary": "Debian Security Advisory DSA-5957 vom 2025-07-03",
"url": "https://lists.debian.org/debian-security-announce/2025/msg00121.html"
},
{
"category": "external",
"summary": "Debian Security Advisory DLA-4249 vom 2025-07-23",
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00012.html"
}
],
"source_lang": "en-US",
"title": "MediaWiki: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-07-23T22:00:00.000+00:00",
"generator": {
"date": "2025-07-24T07:52:21.581+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.4.0"
}
},
"id": "WID-SEC-W-2025-1438",
"initial_release_date": "2025-06-30T22:00:00.000+00:00",
"revision_history": [
{
"date": "2025-06-30T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2025-07-02T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates aufgenommen"
},
{
"date": "2025-07-03T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2025-07-23T22:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von Debian aufgenommen"
}
],
"status": "final",
"version": "4"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c1.39.13",
"product": {
"name": "Open Source MediaWiki \u003c1.39.13",
"product_id": "T044971"
}
},
{
"category": "product_version",
"name": "1.39.13",
"product": {
"name": "Open Source MediaWiki 1.39.13",
"product_id": "T044971-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:mediawiki:mediawiki:1.39.13"
}
}
},
{
"category": "product_version_range",
"name": "\u003c1.42.7",
"product": {
"name": "Open Source MediaWiki \u003c1.42.7",
"product_id": "T044972"
}
},
{
"category": "product_version",
"name": "1.42.7",
"product": {
"name": "Open Source MediaWiki 1.42.7",
"product_id": "T044972-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:mediawiki:mediawiki:1.42.7"
}
}
},
{
"category": "product_version_range",
"name": "\u003c1.43.2",
"product": {
"name": "Open Source MediaWiki \u003c1.43.2",
"product_id": "T044973"
}
},
{
"category": "product_version",
"name": "1.43.2",
"product": {
"name": "Open Source MediaWiki 1.43.2",
"product_id": "T044973-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:mediawiki:mediawiki:1.43.2"
}
}
},
{
"category": "product_version_range",
"name": "\u003c1.44.0",
"product": {
"name": "Open Source MediaWiki \u003c1.44.0",
"product_id": "T045009"
}
},
{
"category": "product_version",
"name": "1.44.0",
"product": {
"name": "Open Source MediaWiki 1.44.0",
"product_id": "T045009-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:mediawiki:mediawiki:1.44.0"
}
}
}
],
"category": "product_name",
"name": "MediaWiki"
}
],
"category": "vendor",
"name": "Open Source"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-32072",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-32072"
},
{
"cve": "CVE-2025-6589",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-6589"
},
{
"cve": "CVE-2025-6590",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-6590"
},
{
"cve": "CVE-2025-6591",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-6591"
},
{
"cve": "CVE-2025-6592",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-6592"
},
{
"cve": "CVE-2025-6593",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-6593"
},
{
"cve": "CVE-2025-6594",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-6594"
},
{
"cve": "CVE-2025-6595",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-6595"
},
{
"cve": "CVE-2025-6596",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-6596"
},
{
"cve": "CVE-2025-6597",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-6597"
},
{
"cve": "CVE-2025-6926",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-6926"
},
{
"cve": "CVE-2025-6927",
"product_status": {
"known_affected": [
"T044973",
"T044972",
"2951",
"T045009",
"T044971"
]
},
"release_date": "2025-06-30T22:00:00.000+00:00",
"title": "CVE-2025-6927"
}
]
}
CVE-2025-6593 (GCVE-0-2025-6593)
Vulnerability from cvelistv5 – Published: 2026-02-02 23:01 – Updated: 2026-02-04 14:45
VLAI?
EPSS
Title
"{{SITENAME}} registered email address has been changed" email sent to unverified email addresses
Summary
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php.
This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.
Severity ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Wikimedia Foundation | MediaWiki |
Affected:
1.27.0 , < 1.39.13, 1.42.7 1.43.2, 1.44.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6593",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-04T14:42:43.119366Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T14:45:35.068Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MediaWiki",
"programFiles": [
"includes/user/User.php"
],
"repo": "https://gerrit.wikimedia.org/g/mediawiki/core/+/refs/heads/master",
"vendor": "Wikimedia Foundation",
"versions": [
{
"lessThan": "1.39.13, 1.42.7 1.43.2, 1.44.0",
"status": "affected",
"version": "1.27.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability in Wikimedia Foundation MediaWiki.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003eincludes/user/User.Php\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.\u003c/p\u003e"
}
],
"value": "Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php.\n\nThis issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T23:01:28.857Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T396230"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "\"{{SITENAME}} registered email address has been changed\" email sent to unverified email addresses",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-6593",
"datePublished": "2026-02-02T23:01:28.857Z",
"dateReserved": "2025-06-24T22:27:45.486Z",
"dateUpdated": "2026-02-04T14:45:35.068Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6594 (GCVE-0-2025-6594)
Vulnerability from cvelistv5 – Published: 2026-02-02 23:00 – Updated: 2026-02-03 20:02
VLAI?
EPSS
Title
XSS in Special:ApiSandbox
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js.
This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Wikimedia Foundation | MediaWiki |
Affected:
1.27.0 , < 1.39.13, 1.42.7 1.43.2, 1.44.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-6594",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T19:57:15.720512Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T20:02:11.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MediaWiki",
"programFiles": [
"resources/src/mediawiki.special.apisandbox/ApiSandbox.js"
],
"repo": "https://gerrit.wikimedia.org/g/mediawiki/core/+/refs/heads/master",
"vendor": "Wikimedia Foundation",
"versions": [
{
"lessThan": "1.39.13, 1.42.7 1.43.2, 1.44.0",
"status": "affected",
"version": "1.27.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Wikimedia Foundation MediaWiki.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003eresources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js.\u003c/tt\u003e\u003c/p\u003e\u003cp\u003eThis issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js.\n\nThis issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 0,
"baseSeverity": "NONE",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T23:00:57.791Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T395063"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "XSS in Special:ApiSandbox",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-6594",
"datePublished": "2026-02-02T23:00:57.791Z",
"dateReserved": "2025-06-24T22:28:07.832Z",
"dateUpdated": "2026-02-03T20:02:11.156Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6596 (GCVE-0-2025-6596)
Vulnerability from cvelistv5 – Published: 2026-02-02 22:58 – Updated: 2026-02-03 21:12
VLAI?
EPSS
Title
Vector inserts portlet labels as HTML, allowing for stored XSS through system messages
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js.
This issue affects Vector: from >= 1.40.0 before 1.42.7, 1.43.2, 1.44.0.
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Wikimedia Foundation | Vector |
Affected:
>= 1.40.0 , < 1.42.7, 1.43.2, 1.44.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6596",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T21:11:48.928447Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T21:12:11.934Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Vector",
"programFiles": [
"resources/skins.vector.js/portlets.js",
"resources/skins.vector.legacy.js/portlets.js"
],
"repo": "https://gerrit.wikimedia.org/g/mediawiki/skins/Vector/+/refs/heads/master",
"vendor": "Wikimedia Foundation",
"versions": [
{
"lessThan": "1.42.7, 1.43.2, 1.44.0",
"status": "affected",
"version": "\u003e= 1.40.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Wikimedia Foundation Vector.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003eresources/skins.Vector.Js/portlets.Js\u003c/tt\u003e, \u003ctt\u003eresources/skins.Vector.Legacy.Js/portlets.Js\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects Vector: from \u0026gt;= 1.40.0 before 1.42.7, 1.43.2, 1.44.0.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js.\n\nThis issue affects Vector: from \u003e= 1.40.0 before 1.42.7, 1.43.2, 1.44.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 0,
"baseSeverity": "NONE",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T22:58:20.912Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T396685"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Vector inserts portlet labels as HTML, allowing for stored XSS through system messages",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-6596",
"datePublished": "2026-02-02T22:58:20.912Z",
"dateReserved": "2025-06-24T22:28:16.378Z",
"dateUpdated": "2026-02-03T21:12:11.934Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6592 (GCVE-0-2025-6592)
Vulnerability from cvelistv5 – Published: 2026-02-02 23:02 – Updated: 2026-02-04 14:49
VLAI?
EPSS
Title
Creating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLog
Summary
Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php.
This issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0.
Severity ?
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Wikimedia Foundation | AbuseFilter |
Affected:
fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 , < 1.43.2, 1.44.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6592",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-04T14:48:41.008392Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T14:49:00.406Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "AbuseFilter",
"programFiles": [
"includes/auth/AuthManager.php"
],
"repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/AbuseFilter/+/refs/heads/master",
"vendor": "Wikimedia Foundation",
"versions": [
{
"lessThan": "1.43.2, 1.44.0",
"status": "affected",
"version": "fe0b1cb9e9691faf4d8d9bd80646589f6ec37615",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability in Wikimedia Foundation AbuseFilter.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003eincludes/auth/AuthManager.Php\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0.\u003c/p\u003e"
}
],
"value": "Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php.\n\nThis issue affects AbuseFilter: from fe0b1cb9e9691faf4d8d9bd80646589f6ec37615 before 1.43.2, 1.44.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T23:02:13.300Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T391218"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Creating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLog",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-6592",
"datePublished": "2026-02-02T23:02:13.300Z",
"dateReserved": "2025-06-24T22:27:44.092Z",
"dateUpdated": "2026-02-04T14:49:00.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-32072 (GCVE-0-2025-32072)
Vulnerability from cvelistv5 – Published: 2025-04-11 16:23 – Updated: 2025-11-03 19:53
VLAI?
EPSS
Title
HTML injection in feed output from i18n message
Summary
Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43.
Severity ?
CWE
- CWE-116 - Improper Encoding or Escaping of Output
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| The Wikimedia Foundation | Mediawiki Core - Feed Utils |
Affected:
1.39 , ≤ 1.43
(semver)
|
Credits
Lucas_Werkmeister_WMDE
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-32072",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-11T16:39:44.476218Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-11T16:40:02.558Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T19:53:18.332Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00012.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mediawiki Core - Feed Utils",
"vendor": "The Wikimedia Foundation",
"versions": [
{
"lessThanOrEqual": "1.43",
"status": "affected",
"version": "1.39",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Lucas_Werkmeister_WMDE"
}
],
"datePublic": "2025-04-11T00:43:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.\u003cp\u003eThis issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43.\u003c/p\u003e"
}
],
"value": "Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43."
}
],
"impacts": [
{
"capecId": "CAPEC-500",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-500 WebView Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-116",
"description": "CWE-116 Improper Encoding or Escaping of Output",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-04-11T16:23:12.186Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1120134"
},
{
"url": "https://phabricator.wikimedia.org/T386175"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTML injection in feed output from i18n message",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-32072",
"datePublished": "2025-04-11T16:23:12.186Z",
"dateReserved": "2025-04-03T21:56:59.952Z",
"dateUpdated": "2025-11-03T19:53:18.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6597 (GCVE-0-2025-6597)
Vulnerability from cvelistv5 – Published: 2026-02-02 22:57 – Updated: 2026-02-03 21:12
VLAI?
EPSS
Title
MediaWiki should not consider autocreation as login for the purposes of security reauthentication
Summary
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php.
This issue affects MediaWiki: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.
Severity ?
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Wikimedia Foundation | MediaWiki |
Affected:
* , < 1.39.13, 1.42.7, 1.43.2, 1.44.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6597",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T21:12:25.366642Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T21:12:31.606Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MediaWiki",
"programFiles": [
"includes/auth/AuthManager.php"
],
"repo": "https://gerrit.wikimedia.org/g/mediawiki/core/+/refs/heads/master",
"vendor": "Wikimedia Foundation",
"versions": [
{
"lessThan": "1.39.13, 1.42.7, 1.43.2, 1.44.0",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability in Wikimedia Foundation MediaWiki.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003eincludes/auth/AuthManager.Php\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects MediaWiki: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.\u003c/p\u003e"
}
],
"value": "Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php.\n\nThis issue affects MediaWiki: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 0,
"baseSeverity": "NONE",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T22:57:30.161Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T389009"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "MediaWiki should not consider autocreation as login for the purposes of security reauthentication",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-6597",
"datePublished": "2026-02-02T22:57:30.161Z",
"dateReserved": "2025-06-24T22:28:17.263Z",
"dateUpdated": "2026-02-03T21:12:31.606Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6927 (GCVE-0-2025-6927)
Vulnerability from cvelistv5 – Published: 2026-02-02 22:55 – Updated: 2026-02-03 21:12
VLAI?
EPSS
Title
Autoblocks from global account suppressions are publicly visible
Summary
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php, includes/api/ApiQueryBlocks.Php.
This issue affects MediaWiki: from >= 1.42.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.
Severity ?
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Wikimedia Foundation | MediaWiki |
Affected:
>= 1.42.0 , < 1.39.13, 1.42.7 1.43.2, 1.44.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6927",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T21:12:43.710900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T21:12:49.615Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MediaWiki",
"programFiles": [
"includes/specials/pagers/BlockListPager.php",
"includes/api/ApiQueryBlocks.php"
],
"repo": "https://gerrit.wikimedia.org/g/mediawiki/core/+/refs/heads/master",
"vendor": "Wikimedia Foundation",
"versions": [
{
"lessThan": "1.39.13, 1.42.7 1.43.2, 1.44.0",
"status": "affected",
"version": "\u003e= 1.42.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability in Wikimedia Foundation MediaWiki.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003eincludes/specials/pagers/BlockListPager.Php\u003c/tt\u003e, \u003ctt\u003eincludes/api/ApiQueryBlocks.Php\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects MediaWiki: from \u0026gt;= 1.42.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.\u003c/p\u003e"
}
],
"value": "Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php, includes/api/ApiQueryBlocks.Php.\n\nThis issue affects MediaWiki: from \u003e= 1.42.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.3,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T22:55:09.395Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T397595"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Autoblocks from global account suppressions are publicly visible",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-6927",
"datePublished": "2026-02-02T22:55:09.395Z",
"dateReserved": "2025-06-30T14:30:22.357Z",
"dateUpdated": "2026-02-03T21:12:49.615Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6595 (GCVE-0-2025-6595)
Vulnerability from cvelistv5 – Published: 2026-02-02 22:59 – Updated: 2026-02-03 19:59
VLAI?
EPSS
Summary
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MultimediaViewer.This issue affects MultimediaViewer: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.
Severity ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Wikimedia Foundation | MultimediaViewer |
Affected:
* , < 1.39.13, 1.42.7, 1.43.2, 1.44.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-6595",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T19:53:03.349449Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T19:59:38.667Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MultimediaViewer",
"repo": "https://gerrit.wikimedia.org/g/mediawiki/extensions/MultimediaViewer/+/refs/heads/master",
"vendor": "Wikimedia Foundation",
"versions": [
{
"lessThan": "1.39.13, 1.42.7, 1.43.2, 1.44.0",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Wikimedia Foundation MultimediaViewer.\u003cp\u003eThis issue affects MultimediaViewer: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027) vulnerability in Wikimedia Foundation MultimediaViewer.This issue affects MultimediaViewer: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 0,
"baseSeverity": "NONE",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or \u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T22:59:42.507Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T394863"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-6595",
"datePublished": "2026-02-02T22:59:42.507Z",
"dateReserved": "2025-06-24T22:28:10.233Z",
"dateUpdated": "2026-02-03T19:59:38.667Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6591 (GCVE-0-2025-6591)
Vulnerability from cvelistv5 – Published: 2026-02-02 23:02 – Updated: 2026-02-04 15:32
VLAI?
EPSS
Title
HTML injection in API action=feedcontributions output from i18n message
Summary
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php.
This issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0.
Severity ?
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Wikimedia Foundation | MediaWiki |
Affected:
* , < 1.39.13, 1.42.7 1.43.2, 1.44.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-6591",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-04T15:32:29.650427Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-04T15:32:59.819Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MediaWiki",
"programFiles": [
"includes/api/ApiFeedContributions.php"
],
"repo": "https://gerrit.wikimedia.org/g/mediawiki/core/+/refs/heads/master",
"vendor": "Wikimedia Foundation",
"versions": [
{
"lessThan": "1.39.13, 1.42.7 1.43.2, 1.44.0",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability in Wikimedia Foundation MediaWiki.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003eincludes/api/ApiFeedContributions.Php\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0.\u003c/p\u003e"
}
],
"value": "Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php.\n\nThis issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 0,
"baseSeverity": "NONE",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T23:02:33.728Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T392276"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "HTML injection in API action=feedcontributions output from i18n message",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-6591",
"datePublished": "2026-02-02T23:02:33.728Z",
"dateReserved": "2025-06-24T22:27:42.888Z",
"dateUpdated": "2026-02-04T15:32:59.819Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6926 (GCVE-0-2025-6926)
Vulnerability from cvelistv5 – Published: 2025-07-03 16:23 – Updated: 2025-11-03 20:07
VLAI?
EPSS
Title
Security Authentication Bypass in CentralAuth
Summary
Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
Severity ?
8.8 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Wikimedia Foundation | Mediawiki - CentralAuth Extension |
Affected:
1.39.x , < 1.39.13
(semver)
Affected: 1.42.x , < 1.42.7 (semver) Affected: 1.43.x , < 1.43.2 (semver) |
Credits
Tgr
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-6926",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-07-03T17:40:14.857430Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-07-03T17:41:44.046Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-11-03T20:07:17.094Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/07/msg00012.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Mediawiki - CentralAuth Extension",
"vendor": "Wikimedia Foundation",
"versions": [
{
"lessThan": "1.39.13",
"status": "affected",
"version": "1.39.x",
"versionType": "semver"
},
{
"lessThan": "1.42.7",
"status": "affected",
"version": "1.42.x",
"versionType": "semver"
},
{
"lessThan": "1.43.2",
"status": "affected",
"version": "1.43.x",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Tgr"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.\u003cp\u003eThis issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.\u003c/p\u003e"
}
],
"value": "Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - CentralAuth Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2."
}
],
"impacts": [
{
"capecId": "CAPEC-178",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-178: Bypass Authentication"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-07-10T23:37:08.753Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T389010"
},
{
"url": "https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1165117"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Security Authentication Bypass in CentralAuth",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-6926",
"datePublished": "2025-07-03T16:23:56.503Z",
"dateReserved": "2025-06-30T14:28:12.256Z",
"dateUpdated": "2025-11-03T20:07:17.094Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6590 (GCVE-0-2025-6590)
Vulnerability from cvelistv5 – Published: 2026-02-02 23:03 – Updated: 2026-02-03 21:11
VLAI?
EPSS
Title
Complete content leak of private wikis due to PasswordReset Wikitext injection in error message
Summary
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLUserTextField.Php.
This issue affects MediaWiki: from * through 1.39.12, 1.42.76 1.43.1, 1.44.0.
Severity ?
CWE
- CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Wikimedia Foundation | MediaWiki |
Affected:
* , ≤ 1.39.12, 1.42.76 1.43.1, 1.44.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6590",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T21:11:34.380217Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T21:11:40.284Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MediaWiki",
"programFiles": [
"includes/htmlform/fields/HTMLUserTextField.php"
],
"repo": "https://gerrit.wikimedia.org/g/mediawiki/core/+/refs/heads/master",
"vendor": "Wikimedia Foundation",
"versions": [
{
"lessThanOrEqual": "1.39.12, 1.42.76 1.43.1, 1.44.0",
"status": "affected",
"version": "*",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003eincludes/htmlform/fields/HTMLUserTextField.Php\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects MediaWiki: from * through 1.39.12, 1.42.76 1.43.1, 1.44.0.\u003c/p\u003e"
}
],
"value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLUserTextField.Php.\n\nThis issue affects MediaWiki: from * through 1.39.12, 1.42.76 1.43.1, 1.44.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 4.6,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T23:03:07.979Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T392746"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Complete content leak of private wikis due to PasswordReset Wikitext injection in error message",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-6590",
"datePublished": "2026-02-02T23:03:07.979Z",
"dateReserved": "2025-06-24T22:27:41.836Z",
"dateUpdated": "2026-02-03T21:11:40.284Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6589 (GCVE-0-2025-6589)
Vulnerability from cvelistv5 – Published: 2026-02-02 23:03 – Updated: 2026-02-03 21:11
VLAI?
EPSS
Title
With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList
Summary
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php.
This issue affects MediaWiki: >= 1.42.0.
Severity ?
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Wikimedia Foundation | MediaWiki |
Affected:
>= 1.42.0
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-6589",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-03T21:11:14.495769Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-03T21:11:20.527Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "MediaWiki",
"programFiles": [
"includes/specials/pagers/BlockListPager.php"
],
"repo": "https://gerrit.wikimedia.org/g/mediawiki/core/+/refs/heads/master",
"vendor": "Wikimedia Foundation",
"versions": [
{
"status": "affected",
"version": "\u003e= 1.42.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Vulnerability in Wikimedia Foundation MediaWiki.\u003cp\u003e This vulnerability is associated with program files \u003ctt\u003eincludes/specials/pagers/BlockListPager.Php\u003c/tt\u003e.\u003c/p\u003e\u003cp\u003eThis issue affects MediaWiki: \u0026gt;= 1.42.0.\u003c/p\u003e"
}
],
"value": "Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php.\n\nThis issue affects MediaWiki: \u003e= 1.42.0."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 2.1,
"baseSeverity": "LOW",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/AU:Y",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-02T23:03:45.939Z",
"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"shortName": "wikimedia-foundation"
},
"references": [
{
"url": "https://phabricator.wikimedia.org/T391343"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without \u0027hideuser\u0027 can see the hidden username in the BlockList",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
"assignerShortName": "wikimedia-foundation",
"cveId": "CVE-2025-6589",
"datePublished": "2026-02-02T23:03:45.939Z",
"dateReserved": "2025-06-24T22:27:40.662Z",
"dateUpdated": "2026-02-03T21:11:20.527Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…