9419 matches found
mediawiki-CVE-2026-100382
Reproduction en laboratoire - CVE-2026-100382 injection de commande OS dans ExternalData En quoi consiste ce laboratoire MediaWiki 1.43 image officielle, SQLite + ExternalData3.6.1 dernière version vulnérable, monté en lecture seule depuis ../mediawiki-extensions-ExternalData. Boucle locale...
CVE-2026-58025
CVE-2026-58025 — RCE par désérialisation PHP dans MediaWiki via l'import d'entrées de journal WikiImporter → LogEntryBase::extractParams → unserialize logparams contrôlés par l'utilisateur → RCE Vue d'ensemble CVE-2026-58025 est une vulnérabilité critique CVSS 9.8 de désérialisation de données no...
cve-2020-29007
CVEID : CVE-2020-29007 Nom du/des produits et versions concernés : Mediawiki Score toutes les versions jusqu'à 0.3.0 Type de problème : CWE-96: Neutralisation incorrecte des directives dans du code sauvegardé statiquement « Injection de code statique » Résumé Score est une extension Mediawiki qui...
MediaWiki EasyTimeline - Code Injection RCE
MediaWiki EasyTimeline Timeline extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted block can inject ploticus 'proc getdata' a...
Invoke-ATTACKAPI
Invoke-ATTACKAPI DEPRECATED WE RECOMMEND TO USE: https://github.com/Cyb3rWard0g/ATTACK-Python-Client A PowerShell script to interact with the MITRE ATT&CK Framework via its own API in order to gather information about techniques, tactics, groups, software and references provided by the MITRE ATT&...
CVE-2017-8809_MediaWiki_RFD
CVE-2017-8809 - RFDReflected File Download for MediaWiki A remote user can create a specially crafted URL for the target site that, when loaded by the target user, will cause the 'api.php' script to download a file containing shell commands CVE-2017-8809. The file will be served by the target sit...
CVE-2025-61638
CVE-2025-61638 node . "https://www.mediawiki.org/w/api.php" fixed More exploitable targets can be found at https://www.mediawiki.org/wiki/SitesusingMediaWiki. https://phabricator.wikimedia.org/T401099 https://vulners.com/cve/CVE-2025-61638 XSS attack requires editing entries, so at least xss !==...
The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment allows a hacker to perform cross-site scripting attacks.
The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attack...
The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment allows a hacker to perform cross-site scripting attacks.
The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attack...
The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment allows a hacker to perform cross-site scripting attacks.
The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attack...
The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment allows a hacker to perform cross-site scripting attacks.
The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attack...
The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment allows a hacker to perform cross-site scripting attacks.
The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attack...
CVE-2026-103446
CVE-2026-103446 : Exécution anonyme de fragments WikiLambda Rapporteur : Marco Paciaroni BomboBombone. L'API abstractwikirunfragment ne vérifiait pas la permission requise pour les fragments non enregistrés fournis par l'appelant. Les requêtes anonymes pouvaient donc envoyer des implémentations...
CVE-2026-102975
CVE-2026-102975 : contournement d'autorisation de désuppression de l'API RevisionDelete Rapporteur : Marco Paciaroni BomboBombone. L'action action=revisiondelete de MediaWiki acceptait suppress=no sans vérifier suppressrevision. Un appelant disposant de viewsuppressed et d'un droit de gestion...
CVE-2026-102973
CVE-2026-102973 : contournement du hook d'autorisation de l'API email Rapporteur : Marco Paciaroni BomboBombone. Le chemin d'accès API action=emailuser de MediaWiki n'invoquait pas le hook EmailUserAuthorizeSend. Lorsqu'une extension ou une politique de site utilisait ce hook pour refuser un...
CVE-2026-102971
CVE-2026-102971 : divulgation de l'ID de l'auteur d'une révision masquée Rapporteur : Marco Paciaroni BomboBombone. La réponse de révision compatible RESTBase de MediaWiki pouvait inclure l'ID utilisateur numérique d'un auteur dont le nom avait été masqué. La réponse définissait toujours usertext...
Linux Distros Unpatched Vulnerability : CVE-2026-102967
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...
Linux Distros Unpatched Vulnerability : CVE-2026-102971
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...
Linux Distros Unpatched Vulnerability : CVE-2026-102966
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. Note that Nessus relies on the presence of the package as reported by the vendor. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description...
CVE-2026-102796
A flaw was found in the MediaWiki UserPageViewTracker extension. An unauthenticated remote attacker can exploit this vulnerability by submitting crafted input through the filterusers or ignoreusers parameters. This allows the attacker to perform Structured Query Language SQL injection, potentiall...