MediaWiki EasyTimeline - Code Injection RCE

MediaWiki EasyTimeline Timeline extension versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 contain a code injection vulnerability caused by insufficient neutralization of newlines in TextData text attributes in EasyTimeline.pl / Timeline.php. A crafted block can inject ploticus 'proc getdata' a...

cve-2020-29007

CVEID : CVE-2020-29007 Nom du/des produits et versions concernés : Mediawiki Score toutes les versions jusqu'à 0.3.0 Type de problème : CWE-96: Neutralisation incorrecte des directives dans du code sauvegardé statiquement « Injection de code statique » Résumé Score est une extension Mediawiki qui...

CVE-2026-58025

CVE-2026-58025 — RCE par désérialisation PHP dans MediaWiki via l'import d'entrées de journal WikiImporter → LogEntryBase::extractParams → unserialize logparams contrôlés par l'utilisateur → RCE Vue d'ensemble CVE-2026-58025 est une vulnérabilité critique CVSS 9.8 de désérialisation de données no...

CVE-2025-61638

CVE-2025-61638 node . "https://www.mediawiki.org/w/api.php" corretto Puoi trovare più obiettivi di attacco su https://www.mediawiki.org/wiki/SitesusingMediaWiki. https://phabricator.wikimedia.org/T401099 https://vulners.com/cve/CVE-2025-61638 L'attacco XSS richiede la modifica di voci, quindi son...

CVE-2017-8809_MediaWiki_RFD

CVE-2017-8809 - RFD Reflected File Download für MediaWiki Ein entfernter Benutzer kann eine speziell präparierte URL für die Zielseite erstellen, die, wenn sie vom Zielbenutzer geladen wird, das Skript 'api.php' dazu bringt, eine Datei mit Shell-Befehlen herunterzuladen CVE-2017-8809. Die Datei...

Invoke-ATTACKAPI

Invoke-ATTACKAPI DEPRECATED WIR EMPFEHLEN ZU VERWENDEN: https://github.com/Cyb3rWard0g/ATTACK-Python-Client Ein PowerShell-Skript zur Interaktion mit dem MITRE ATT&CK Framework über dessen eigene API, um Informationen über Techniken, Taktiken, Gruppen, Software und Referenzen zu sammeln, die vom...

Linux Distros Unpatched Vulnerability : CVE-2026-52854

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser functi...

CVE-2026-52854

The MediaWiki Maps extension (versions before 12.1.3) is vulnerable to stored XSS: the display_map parser function's overlays parameter passes unescaped overlay names to Leaflet's layer-control label code, enabling script execution in any viewer's browser. A PoC exists using {{#display_map:0,0|se...

CVE-2026-52854 mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...

CVE-2026-52854 mediawiki/maps: Stored XSS through the overlays parameter in the display_map parser function

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the displaymap parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the...

Exploit for Deserialization of Untrusted Data in Mediawiki

CVE-2026-58025 — MediaWiki PHP Deserialization RCE via Log Entry...

Debian dsa-6380 : mediawiki - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6380 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6380-1 [email protected] https://www.debian.org/securit...

[SECURITY] [DSA 6380-1] mediawiki security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6380-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 05, 2026 https://www.debian.org/security/faq -...

CVE-2026-58517

A flaw was found in The Wikimedia Foundation Mediawiki - WikiLambda Extension. This vulnerability, caused by improper neutralization of input terminators, allows an attacker to bypass authentication. This could lead to unauthorized access to the system. Mitigation To mitigate this vulnerability,...

CVE-2026-14363

A flaw was found in the Mediawiki Cargo Extension. This vulnerability, identified as SQL Injection, allows an attacker to execute malicious SQL commands. By exploiting improper handling of special characters in SQL commands, an attacker can potentially access, modify, or delete sensitive data...

Linux Distros Unpatched Vulnerability : CVE-2026-58036

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files...

Linux Distros Unpatched Vulnerability : CVE-2026-58035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is...

Linux Distros Unpatched Vulnerability : CVE-2026-58031

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via improper handling of user-supplied input in the Special:Drilldown process. An attacker can execute arbitrary SQL commands by injecting crafted input. Remediation Upgrade mediawiki/cargo to version 3.9.1 or higher...

CVE-2026-14363

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from before 1.43.9,1.44.6,1.45.4...