Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-62668

Summary
Assigner-wikimedia-foundation
Assigner Org ID-c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Published At-18 Oct, 2025 | 04:39
Updated At-20 Oct, 2025 | 16:27
Rejected At-
Credits

Insufficient permission checks in action=growthsetmentor

Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:wikimedia-foundation
Assigner Org ID:c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Published At:18 Oct, 2025 | 04:39
Updated At:20 Oct, 2025 | 16:27
Rejected At:
â–¼CVE Numbering Authority (CNA)
Insufficient permission checks in action=growthsetmentor

Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.

Affected Products
Vendor
Wikimedia FoundationThe Wikimedia Foundation
Product
Mediawiki - GrowthExperiments Extension
Default Status
unaffected
Versions
Affected
  • From master before 1.39 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-276CWE-276 Incorrect Default Permissions
Type: CWE
CWE ID: CWE-276
Description: CWE-276 Incorrect Default Permissions
Metrics
VersionBase scoreBase severityVector
4.06.9MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Version: 4.0
Base score: 6.9
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-131CAPEC-131 Resource Leak Exposure
CAPEC ID: CAPEC-131
Description: CAPEC-131 Resource Leak Exposure
Solutions
Configurations
Workarounds
Exploits
Credits
finder
SomeRandomDeveloper
finder
Urbanecm_WMF
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://phabricator.wikimedia.org/T402600
N/A
https://gerrit.wikimedia.org/r/q/I29a18dbbaf7e2ce2a713233dbc6880032fec3628
N/A
Hyperlink: https://phabricator.wikimedia.org/T402600
Resource: N/A
Hyperlink: https://gerrit.wikimedia.org/r/q/I29a18dbbaf7e2ce2a713233dbc6880032fec3628
Resource: N/A
â–¼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Published At:18 Oct, 2025 | 05:15
Updated At:21 Oct, 2025 | 19:31

Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.06.9MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Secondary
Version: 4.0
Base score: 6.9
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-276Secondaryc4f26cc8-17ff-4c99-b5e2-38fc1793eacc
CWE ID: CWE-276
Type: Secondary
Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://gerrit.wikimedia.org/r/q/I29a18dbbaf7e2ce2a713233dbc6880032fec3628c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
N/A
https://phabricator.wikimedia.org/T402600c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
N/A
Hyperlink: https://gerrit.wikimedia.org/r/q/I29a18dbbaf7e2ce2a713233dbc6880032fec3628
Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Resource: N/A
Hyperlink: https://phabricator.wikimedia.org/T402600
Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

24Records found
CVE-2025-62661
Matching Score-10
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-10
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.08% / 22.76%
||
7 Day CHG~0.00%
Published-21 Oct, 2025 | 19:33
Updated-22 Oct, 2025 | 21:12
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Do permission checking when getting counts of global and local edits, new articles and thanks

Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension: from 1.43 before 1.44.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension
CWE ID-CWE-276
Incorrect Default Permissions
CVE-2025-62695
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-21 Oct, 2025 | 04:02
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through system messages

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension allows Stored XSS.This issue affects Mediawiki - WikiLambda Extension: master.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - WikiLambda Extension
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62666
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.08% / 23.82%
||
7 Day CHG~0.00%
Published-18 Oct, 2025 | 04:47
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
DoS vector through the cirrusbuilddoc query API

Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue affects Mediawiki - CirrusSearch Extension: from master before 1.43.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - CirrusSearch Extension
CWE ID-CWE-770
Allocation of Resources Without Limits or Throttling
CVE-2025-62667
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-18 Oct, 2025 | 04:42
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through article extracts in GrowthExperiments

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Stored XSS.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - GrowthExperiments Extension
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62698
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-20 Oct, 2025 | 18:07
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through system messages in ExternalGuidance

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuidance allows Stored XSS.This issue affects Mediawiki - ExternalGuidance: from master before 1.39.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - ExternalGuidance
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62700
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-20 Oct, 2025 | 17:53
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through a system message in MultiBoilerplate

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - MultiBoilerplate Extensionmaste allows Stored XSS.This issue affects Mediawiki - MultiBoilerplate Extensionmaste: from master before 1.39.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - MultiBoilerplate Extensionmaste
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62694
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 24.72%
||
7 Day CHG~0.00%
Published-21 Oct, 2025 | 04:28
Updated-21 Oct, 2025 | 20:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through a system message

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - WikiLove Extension allows Stored XSS.This issue affects Mediawiki - WikiLove Extension: 1.39.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - WikiLove Extension
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62662
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-18 Oct, 2025 | 04:19
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through system messages in AdvancedSearch

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master before 1.39.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - AdvancedSearch Extension
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62702
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-21 Oct, 2025 | 04:42
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through system messages

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.44.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - PageTriage Extension
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62696
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-1.19% / 78.49%
||
7 Day CHG-0.37%
Published-21 Oct, 2025 | 03:58
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Multiple critical security issues in Springboard

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in The Wikimedia Foundation Mediawiki Foundation - Springboard Extension allows Command Injection.This issue affects Mediawiki Foundation - Springboard Extension: master.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki Foundation - Springboard Extension
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2025-62671
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-18 Oct, 2025 | 04:24
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through wikitext in Cargo

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: master.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - Cargo Extension
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62701
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-21 Oct, 2025 | 04:45
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through system messages

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - Wikistories
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-32076
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.39% / 59.26%
||
7 Day CHG~0.00%
Published-11 Apr, 2025 | 16:23
Updated-15 Apr, 2025 | 18:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Evil regex used to process user-provided data in VisualData

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Data Extension: from 1.39 through 1.43.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - Visual Data Extension
CWE ID-CWE-20
Improper Input Validation
CVE-2025-62693
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-20 Oct, 2025 | 17:51
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through system messages in LastModified

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - LastModified Extension allows Stored XSS.This issue affects Mediawiki - LastModified Extension: from master before 1.39.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - LastModified Extension
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62670
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-18 Oct, 2025 | 04:29
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through a system message in FlexDiagrams

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams Extension allows Stored XSS.This issue affects Mediawiki - FlexDiagrams Extension: master.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - FlexDiagrams Extension
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62663
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-18 Oct, 2025 | 04:16
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through a system message in UploadWizard

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard Extension allows Stored XSS.This issue affects Mediawiki - UploadWizard Extension: from master before 1.39.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - UploadWizard Extension
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62664
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-18 Oct, 2025 | 04:13
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through a system message in ImageRating

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ImageRating Extension allows Stored XSS.This issue affects Mediawiki - ImageRating Extension: from master before 1.39.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - ImageRating Extension
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62699
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.08% / 22.82%
||
7 Day CHG~0.00%
Published-21 Oct, 2025 | 03:48
Updated-21 Oct, 2025 | 20:20
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Special:Translate tool does not use the correct IP and User-Agent in the CheckUser tool

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Translate Extension allows Footprinting. Translate extension appears to use jobs to make edits to translation pages. This causes the CheckUser tool to log the wrong IP and User-Agent making these edits un-auditable via the CheckUser tool.This issue affects Mediawiki - Translate Extension: from master before 1.39.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - Translate Extension
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2025-62669
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.08% / 23.82%
||
7 Day CHG~0.00%
Published-18 Oct, 2025 | 04:34
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - CentralAuth Extension
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2025-32072
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.45% / 63.37%
||
7 Day CHG~0.00%
Published-11 Apr, 2025 | 16:23
Updated-03 Nov, 2025 | 20:18
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
HTML injection in feed output from i18n message

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki Core - Feed Utils
CWE ID-CWE-116
Improper Encoding or Escaping of Output
CVE-2025-32080
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.36% / 57.98%
||
7 Day CHG~0.00%
Published-11 Apr, 2025 | 16:24
Updated-15 Apr, 2025 | 18:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Cross-origin data leak in mobilefrontend via lazy load images

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - Mobile Frontend Extension
CWE ID-CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
CVE-2025-32075
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.39% / 59.26%
||
7 Day CHG~0.00%
Published-11 Apr, 2025 | 16:21
Updated-15 Apr, 2025 | 18:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
IP and user agent leaks in Extension:Tabs

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extension: from 1.39 through 1.43.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - Tabs Extension
CWE ID-CWE-20
Improper Input Validation
CVE-2025-11937
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.09% / 25.61%
||
7 Day CHG~0.00%
Published-18 Oct, 2025 | 05:14
Updated-21 Oct, 2025 | 19:31
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Stored XSS through a system message in SecurePoll

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Extension allows Stored XSS.This issue affects Mediawiki - SecurePoll Extension: master.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - SecurePoll Extension
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-32078
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-6.9||MEDIUM
EPSS-0.39% / 59.26%
||
7 Day CHG~0.00%
Published-11 Apr, 2025 | 16:24
Updated-15 Apr, 2025 | 18:39
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
XSSes and potential RCE in Special:VersionCompare

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Version Compare Extension: from 1.39 through 1.43.

Action-Not Available
Vendor-Wikimedia Foundation
Product-Mediawiki - Version Compare Extension
CWE ID-CWE-116
Improper Encoding or Escaping of Output
Details not found