Linux Distros Unpatched Vulnerability : CVE-2023-37301

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended...

Linux Distros Unpatched Vulnerability : CVE-2021-45473

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL aka a page-information sidebar...

Linux Distros Unpatched Vulnerability : CVE-2021-45472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution...

starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions

Summary Page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Details The descriptions, which are unsanitized, are inserted as raw HTML:...

BIT-MEDIAWIKI-2024-34502

An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will attempt to make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit...

CVE-2023-37301

An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntity for undo and restore, the intended interaction with AbuseFilter does not occur...

CVE-2023-37302

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate from resources/wikibase/templates.js for quotes which can be in a title attribute...

CVE-2023-45371

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. There is no rate limit for merging items...

CVE-2023-22910

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase date formatting via wikibase-time-precision- fields. This allows JavaScript execution by staff/admin users who do not intentionally have the editsitejs...

CVE-2023-45372

An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. During item merging, ItemMergeInteractor does not have an edit filter running e.g., AbuseFilter...

CVE-2022-34750

An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the...

CVE-2019-19327

ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT...

CVE-2019-19328

ui/editor/tooltip/Rdf.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection in tooltips for entities. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT...

CVE-2025-32069

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting XSS.This issue affects Mediawiki - Wikibase Media Info Extension: from 1.39 through 1.43...

Improper Encoding or Escaping of Output

Overview wikibase/wikibase is a Structured data repository for MediaWiki Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the ImageHandler::getDimensionsString method. An attacker can manipulate the output of the script by injecting malicious code in...

CVE-2025-32069

The CVE-2025-32069 issue is an Improper Input Validation vulnerability in the Wikimedia Foundation’s MediaWiki Wikibase Media Info Extension, affecting versions 1.39 through 1.43. The root cause involves input validation flaws leading to Cross-Site Scripting (XSS) . Connected sources corroborate ...

CVE-2025-32069 Wikitext stored XSS on filepages due to dangerous WBMI serialization

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting XSS.This issue affects Mediawiki - Wikibase Media Info Extension: from 1.39 through 1.43...

CVE-2025-32071

CVE-2025-32071 affects the Wikimedia Foundation MediaWiki Wikidata Extension (Wikibase/Wikidata). Affects MediaWiki-Wikidata Extension versions 1.39 through 1.43 where improper input validation in ImageHandler::getDimensionsString() enables Cross-Site Scripting (XSS) via the widthheight message. ...

MediaWiki 输入验证错误漏洞

MediaWiki is a suite of free and freely available web-based Wiki engines from the Wikimedia USA Foundation. The product can be used to deploy in-house knowledge management and content management systems. MediaWiki - A security vulnerability exists in Wikibase Media Info Extension versions 1.39...

PT-2025-16133 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: Mediawiki - Wikibase Media Info Extension versions 1.39 through 1.43 Description: The issue is related to Improper Input Validation, which allows Cross-Site Scripting XSS. This exposes systems to XSS risk. Recommendations: For versions 1.39...