Mediawiki vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-40597 An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1.High 7.5 · Jul 6, 2024
• CVE-2024-34507 An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1.High 7.4 · May 5, 2024
• CVE-2024-34506 An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1.High 7.5 · May 5, 2024
• CVE-2024-34502 An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1.Critical 9.8 · May 5, 2024
• CVE-2023-29134 An issue was discovered in the Cargo extension for MediaWiki through 1.39.3.High 8.6 · Mar 27, 2024
• CVE-2023-45371 An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.High 7.5 · Oct 9, 2023
• CVE-2023-45363 An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.High 7.5 · Oct 9, 2023
• CVE-2023-3550 Mediawiki v1.40.0 does not validate namespaces used in XML files.High 7.3 · Sep 25, 2023
• CVE-2023-37303 An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.Critical 9.8 · Jun 30, 2023
• CVE-2020-29007 The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable.Critical 9.8 · Apr 15, 2023
• CVE-2023-29141 An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3.Critical 9.8 · Mar 31, 2023
• CVE-2022-28204 A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2.High 7.5 · Sep 19, 2022
• CVE-2022-28203 A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2.High 7.5 · Sep 19, 2022
• CVE-2022-34750 An issue was discovered in MediaWiki through 1.38.1.High 7.5 · Jun 28, 2022
• CVE-2022-28323 An issue was discovered in MediaWiki through 1.37.2.High 7.5 · Apr 30, 2022
• CVE-2022-29906 The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin usCritical 9.8 · Apr 29, 2022
• CVE-2022-29904 The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with certain '-' and '_' conCritical 9.8 · Apr 29, 2022
• CVE-2022-29547 The CreateRedirect extension before 2022-04-14 for MediaWiki does not properly check whether the user has permissions to edit the target page.High 7.5 · Apr 20, 2022
• CVE-2022-28209 An issue was discovered in Mediawiki through 1.37.1.Critical 9.8 · Mar 30, 2022
• CVE-2022-28206 An issue was discovered in MediaWiki through 1.37.1.Critical 9.8 · Mar 30, 2022
• CVE-2022-28205 An issue was discovered in MediaWiki through 1.37.1.Critical 9.8 · Mar 30, 2022
• CVE-2017-0371 MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors viHigh 7.5 · Feb 18, 2022
• CVE-2021-46149 An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.High 7.5 · Jan 10, 2022
• CVE-2021-46147 An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.High 8.8 · Jan 10, 2022
• CVE-2021-44858 An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1.High 7.5 · Dec 20, 2021