CVE-2026-102975

CVE-2026-102975: RevisionDelete API unsuppression authorization bypass Reporter: Marco Paciaroni BomboBombone. MediaWiki's action=revisiondelete accepted suppress=no without checking suppressrevision. A caller with viewsuppressed and a type-specific management right could remove the restricted bi...

CVE-2026-103446

CVE-2026-103446: Anonymous WikiLambda fragment execution Reporter: Marco Paciaroni BomboBombone. The abstractwikirunfragment API did not check the permission required for caller-supplied unsaved fragments. Anonymous requests could therefore send native implementations to the configured WikiLambda...

CVE-2026-102971

CVE-2026-102971: hidden revision author ID disclosure Reporter: Marco Paciaroni BomboBombone. MediaWiki's RESTBase-compatible revision response could include the numeric user ID of an author whose name had been hidden. The response still set usertext to null and marked the author as hidden, but t...

CVE-2017-8809_MediaWiki_RFD

CVE-2017-8809 - RFDReflected File Download for MediaWiki A remote user can create a specially crafted URL for the target site that, when loaded by the target user, will cause the 'api.php' script to download a file containing shell commands CVE-2017-8809. The file will be served by the target sit...

CVE-2026-102973

CVE-2026-102973: API email authorization hook bypass Reporter: Marco Paciaroni BomboBombone. MediaWiki's action=emailuser API path did not invoke the EmailUserAuthorizeSend hook. When an extension or site policy used that hook to deny a sender, the web form enforced the denial while the API path...

cve-2020-29007

CVEID : CVE-2020-29007 Name of the affected products and versions : Mediawiki Score all versions up to 0.3.0 Problem type : CWE-96: Improper Neutralization of Directives in Statically Saved Code ‘Static Code Injection’ Summary Score is a Mediawiki extension which generates musical notation based ...

CVE-2026-116887

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payloa...

CVE-2026-116890

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like...

CVE-2026-116880

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup,...

CVE-2026-116882

Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...

CVE-2026-116886

Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Brows...

CVE-2026-116881

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query...

CVE-2026-116883

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

CVE-2026-116885

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into opening a crafted look...

CVE-2026-116879

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced...

CVE-2026-116873

Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types i...

CVE-2026-116876

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, EditProtectionUpdater applies indefinite edit and move...

CVE-2026-116878

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows anonymous attackers to force quadratic computation by supplying a zero limit to Special:PropertyLabelSimilarity. Attackers can send repeated requests with limit=0 to bypass the SQL...

CVE-2026-116877

Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using setrecurringevent without an end date to generate...

CVE-2026-116872

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalizecompactform that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:... or has:... expressions to...