CVE-2025-11937 Stored XSS through a system message in SecurePoll

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Extension allows Stored XSS.This issue affects Mediawiki - SecurePoll Extension: master...

CVE-2025-11937

CVE-2025-11937 pertains to a Stored XSS vulnerability in the Wikimedia Foundation MediaWiki SecurePoll extension. The issue arises from Improper Neutralization of Input During Web Page Generation, enabling stored cross-site scripting. Affected component: MediaWiki SecurePoll extension (master bra...

CVE-2025-11937 Stored XSS through a system message in SecurePoll

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Extension allows Stored XSS.This issue affects Mediawiki - SecurePoll Extension: master...

CVE-2025-62666

CVE-2025-62666 affects MediaWiki, CirrusSearch Extension. Root cause: unrestricted resource allocation/throttling leads to HTTP DoS. Impact: denial of service over HTTP for CirrusSearch Extension used with MediaWiki, from master before 1.43. Exploitation details are not fully specified in the pro...

CVE-2025-62666 DoS vector through the cirrusbuilddoc query API

Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue affects Mediawiki - CirrusSearch Extension: from master before 1.43...

CVE-2025-62666 DoS vector through the cirrusbuilddoc query API

Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue affects Mediawiki - CirrusSearch Extension: from master before 1.43...

CVE-2025-62667 Stored XSS through article extracts in GrowthExperiments

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Stored XSS.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39...

CVE-2025-62667 Stored XSS through article extracts in GrowthExperiments

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Stored XSS.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39...

CVE-2025-62667

CVE-2025-62667 is a stored XSS vulnerability in the MediaWiki GrowthExperiments Extension. The issue arises from improper neutralization of user-supplied input during web page generation, allowing injected scripts/HTML via the extension’s handling of article extracts. Affected component: GrowthEx...

CVE-2025-62668

CVE-2025-62668 affects the Wikimedia Foundation MediaWiki GrowthExperiments Extension. The issue is an Incorrect Default Permissions vulnerability that leads to Resource Leak Exposure due to improperly set default permissions. Affected scope is MediaWiki GrowthExperiments Extension from master be...

CVE-2025-62668 Insufficient permission checks in action=growthsetmentor

Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39...

CVE-2025-62668 Insufficient permission checks in action=growthsetmentor

Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39...

CVE-2025-62669 UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39...

CVE-2025-62669

The CVE-2025-62669 entry concerns Wikimedia’s MediaWiki CentralAuth Extension, describing a resource disclosure vulnerability that exposes sensitive information. Multiple sources (NVD entry, Red Hat, EU ENISA, CNVD, CVE/CVEList, and vuln enrichment) align on: affected component is CentralAuth Ext...

CVE-2025-62670 Stored XSS through a system message in FlexDiagrams

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams Extension allows Stored XSS.This issue affects Mediawiki - FlexDiagrams Extension: master...

CVE-2025-62670

CVE-2025-62670 affects MediaWiki’s FlexDiagrams Extension (master). The vulnerability is an XSS flaw caused by improper neutralization of input during web page generation, enabling stored XSS in wiki pages. Multiple sources (NVD, Red Hat, CNVD, EU ENISA) corroborate a stored XSS condition in the ...

CVE-2025-62670 Stored XSS through a system message in FlexDiagrams

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams Extension allows Stored XSS.This issue affects Mediawiki - FlexDiagrams Extension: master...

CVE-2025-62671

CVE-2025-62671 is a Stored XSS vulnerability in the Mediawiki Cargo Extension (master). The issue arises from improper input neutralization during web page generation, allowing malicious scripts to be stored and executed when affected content is viewed. Affected component: mediawiki/cargo. Remedi...

CVE-2025-62671 Stored XSS through wikitext in Cargo

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: master...

CVE-2025-62671 Stored XSS through wikitext in Cargo

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: master...