CVE-2026-25784

The BlueSpice software, specifically the bluespice/wiki container image, is vulnerable to privilege escalation due to an insecure default configuration in the token authenticator component (mwstake/mediawiki-component-token-authenticator ). The issue arises because the $mwsgTokenAuthenticatorServ...

CVE-2026-25784 bluespice/wiki container: Insecure default configuration of service token authentication allows privilege escalation to sysop

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice container image bluespice/wiki allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service...

EUVD-2026-108653

Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice container image bluespice/wiki allows privilege escalation. The default value of $mwsgTokenAuthenticatorServiceCIDR in the container's LocalSettings.php was intended to restrict internal service...

CVE-2024-47815 Cross-site Scripting in IncidentReporting

IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, though all of them require elevated permissions. Some are available to anyone who has the editincidents right, some are available to those w...

CVE-2024-47815: Improper Neutralization of Input During Web Page Generation

IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, though all of them require elevated permissions. Some are available to anyone who has the editincidents right, some are available to those w...

PT-2024-32826

Name of the Vulnerable Software and Affected Versions IncidentReporting versions prior to the version containing commit 43896a4 Description The IncidentReporting MediaWiki extension has multiple Cross-site Scripting issues that require elevated permissions to exploit. These issues affect users wi...

Fedora 23 : mediawiki-1.25.2-2.fc23 (2015-13920)

T94116 SECURITY: Compare API watchlist token in constant time T97391 SECURITY: Escape error message strings in thumb.php T106893 SECURITY: Don't leak autoblocked IP addresses on Special:DeletedContributions T102562 Fix InstantCommons parameters to handle the new HTTPS-only policy of Wikimedia...

mediawiki -- authenticated CSRF vulnerability

A MediaWiki security announcement reports: MediaWiki was found to be vulnerable to login CSRF. An attacker who controls a user account on the target wiki can force the victim to log in as the attacker, via a script on an external website. If the wiki is configured to allow user scripts, say with...

CVE-2007-1721: Undefined Security Weakness

Multiple PHP remote file inclusion vulnerabilities in C-Arbre 0.6PR7 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the rootpath parameter to 1 Richtxtfunctions.inc.php, 2 adddocfile.php, 3 authcheck.php, 4 browsecurrentcategory.inc.php, 5 docfiledetails.php, 6...