Cross Site Scripting (XSS)

mediawiki/cargo is vulnerable to Cross Site Scripting XSS. The vulnerability is due to insufficient input sanitization during web page generation, which allows an attacker to inject and store malicious scripts that are executed in the context of other users when the affected content is viewed...

PT-2025-54592

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.44.3 MediaWiki version 1.45.1 Description A flaw exists in the MediaWiki software related to the file includes/Import/ImportableOldRevisionImporter.Php. The issue concerns program files. Recommendations Update to...

CVE-2025-67646

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the...

CVE-2025-67646

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the...

TableProgressTracking 跨站请求伪造漏洞

TableProgressTracking is an open source MediaWiki extension from Telepedia. A cross-site request forgery vulnerability exists in TableProgressTracking 1.2.0 and earlier versions, which stems from a lack of CSRF token validation in the REST API, and could lead to a cross-site request forgery attac...

CVE-2025-67646

CVE-2025-67646 affects the MediaWiki extension TableProgressTracking. Versions 1.2.0 and earlier do not enforce CSRF token validation in the REST API, allowing an attacker to craft a malicious page that, when loaded by an authenticated wiki user, can perform unintended authenticated actions (e.g....

CVE-2025-67646 TableProgressTracking's missing CSRF protection allows unauthorized state changes

TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in the REST API. As a result, an attacker could craft a malicious webpage that, when visited by an authenticated user on a wiki with the...

Updated mediawiki packages fix security vulnerabilities

i18n XSS vulnerability in HTMLMultiSelectField when sections are used. CVE-2025-3469 "reupload-own" restriction can be bypassed by reverting file. CVE-2025-32696 Cascading protection is not preventing file reversions. CVE-2025-32697 LogPager.php: Restriction enforcer functions do not correctly...

MGASA-2025-0260 Updated mediawiki packages fix security vulnerabilities

i18n XSS vulnerability in HTMLMultiSelectField when sections are used. CVE-2025-3469 "reupload-own" restriction can be bypassed by reverting file. CVE-2025-32696 Cascading protection is not preventing file reversions. CVE-2025-32697 LogPager.php: Restriction enforcer functions do not correctly...

Debian: Security Advisory (DLA-4355-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4355-1] mediawiki security update

Debian LTS Advisory DLA-4355-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin October 31, 2025 https://wiki.debian.org/LTS Package : mediawiki Version : 1:1.35.13-1+deb11u5 CVE ID : CVE-2025-11173 CVE-2025-11261 CVE-2025-61635 CVE-2025-61638 CVE-2025-61639...

DLA-4355-1 mediawiki - security update

Bulletin has no description...

Linux Distros Unpatched Vulnerability : CVE-2025-11261

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is...

Debian dla-4355 : mediawiki - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4355 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4355-1 [email protected]...

MediaWiki CookieConsent Extension Cross-Site Scripting Vulnerability

The MediaWiki CookieConsent Extension is an extension for the MediaWiki platform whose main function is to manage the site's cookie policy and user consent mechanisms. MediaWiki CookieConsent Extension suffers from a cross-site scripting vulnerability that stems from the application's lack of...

Linux Distros Unpatched Vulnerability : CVE-2025-62658

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extension...

Linux Distros Unpatched Vulnerability : CVE-2025-62700

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - MultiBoilerplate...

Linux Distros Unpatched Vulnerability : CVE-2025-62656

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation MediaWiki GlobalBlocking...

Linux Distros Unpatched Vulnerability : CVE-2025-62657

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation MediaWiki PageForms extensio...

Linux Distros Unpatched Vulnerability : CVE-2025-62696

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard...