CVEs we hold for Mediawiki
Records whose assigning authority named Mediawiki as the affected vendor. Newest identifiers first, capped at 200.
CVE-2023-3550Stored XSS leads to privilege escalation in MediaWiki v1.40.0MediaWiki CVE-2018-0505BotPasswords can bypass CentralAuth's account lockmediawiki CVE-2018-0504Information disclosure in Special:Redirect/logidmediawiki CVE-2018-0503$wgRateLimits entry for 'user' overrides 'newbie'mediawiki CVE-2017-8815no title heldn/a MediaWiki before 1.27.4, 1.28.x before 1.28.3, and… CVE-2017-8814no title heldn/a MediaWiki before 1.27.4, 1.28.x before 1.28.3, and… CVE-2017-8812no title heldn/a MediaWiki before 1.27.4, 1.28.x before 1.28.3, and… CVE-2017-8811no title heldn/a MediaWiki before 1.27.4, 1.28.x before 1.28.3, and… CVE-2017-8810no title heldn/a MediaWiki before 1.27.4, 1.28.x before 1.28.3, and… CVE-2017-8809no title heldn/a MediaWiki before 1.27.4, 1.28.x before 1.28.3, and… CVE-2017-8808no title heldn/a MediaWiki before 1.27.4, 1.28.x before 1.28.3, and… CVE-2017-0372Parameters injection in SyntaxHighlight results in multiple vulnerabilitiesmediawiki (SyntaxHighlight extension) CVE-2017-0370Spam blacklist ineffective on encoded URLs inside file inclusion syntax's link parametermediawiki CVE-2017-0369Sysops can undelete pages, although the page is protected against itmediawiki CVE-2017-0368Make rawHTML mode not apply to system messagesmediawiki CVE-2017-0367Having LocalisationCache directory default to system tmp directory is insecuremediawiki CVE-2017-0366SVG filter evasion using default attribute values in DTD declarationmediawiki CVE-2017-0365XSS in SearchHighlighter::highlightText() [requires non-default config]mediawiki CVE-2017-0364Special:Search allows redirects to any interwiki linkmediawiki CVE-2017-0363Special:UserLogin?returnto=interwiki:foo will redirect to external sitesmediawiki CVE-2017-0362"Mark all pages visited" on the watchlist does not require a CSRF tokenmediawiki 30 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.