Mediawiki

Mediawiki

371 vulnerabilities found.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2022-29903

Exploit
  • EPSS 0.07%
  • Published 29.04.2022 04:15:10
  • Last modified 21.11.2024 06:59:56

The Private Domains extension for MediaWiki through 1.37.2 (before 1ad65d4c1c199b375ea80988d99ab51ae068f766) allows CSRF for editing pages that store the extension's configuration. The attacker must trigger a POST request to Special:PrivateDomains.

9.8

CVE-2022-29904

Exploit
  • EPSS 0.9%
  • Published 29.04.2022 04:15:10
  • Last modified 21.11.2024 06:59:56

The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with certain '-' and '_' constraints.

4.3

CVE-2022-29905

Exploit
  • EPSS 0.09%
  • Published 29.04.2022 04:15:10
  • Last modified 21.11.2024 06:59:56

The FanBoxes extension for MediaWiki through 1.37.2 (before 027ffb0b9d6fe0d823810cf03f5b562a212162d4) allows Special:UserBoxes CSRF.

9.8

CVE-2022-29906

Exploit
  • EPSS 0.39%
  • Published 29.04.2022 04:15:10
  • Last modified 21.11.2024 06:59:56

The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user.

6.1

CVE-2022-29907

Exploit
  • EPSS 0.41%
  • Published 29.04.2022 04:15:10
  • Last modified 21.11.2024 06:59:57

The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages.

9.8

CVE-2022-28205

Exploit
  • EPSS 0.34%
  • Published 30.03.2022 07:15:07
  • Last modified 21.11.2024 06:56:57

An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future.

9.8

CVE-2022-28206

Exploit
  • EPSS 0.36%
  • Published 30.03.2022 07:15:07
  • Last modified 21.11.2024 06:56:57

An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights.

9.8

CVE-2022-28209

  • EPSS 0.36%
  • Published 30.03.2022 07:15:07
  • Last modified 21.11.2024 06:56:57

An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect.

6.1

CVE-2022-28202

  • EPSS 0.4%
  • Published 30.03.2022 06:15:06
  • Last modified 21.11.2024 06:56:56

An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.

7.5

CVE-2017-0371

Exploit
  • EPSS 0.21%
  • Published 18.02.2022 23:15:07
  • Last modified 21.11.2024 03:02:51

MediaWiki before 1.23.16, 1.24.x through 1.27.x before 1.27.2, and 1.28.x before 1.28.1 allows remote attackers to discover the IP addresses of Wiki visitors via a style="background-image: attr(title url);" attack within a DIV element that has an att...