Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-6591

Summary
Assigner-wikimedia-foundation
Assigner Org ID-c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Published At-02 Feb, 2026 | 23:02
Updated At-04 Feb, 2026 | 15:32
Rejected At-
Credits

HTML injection in API action=feedcontributions output from i18n message

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0.

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:wikimedia-foundation
Assigner Org ID:c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Published At:02 Feb, 2026 | 23:02
Updated At:04 Feb, 2026 | 15:32
Rejected At:
▼CVE Numbering Authority (CNA)
HTML injection in API action=feedcontributions output from i18n message

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0.

Affected Products
Vendor
Wikimedia FoundationWikimedia Foundation
Product
MediaWiki
Repo
https://gerrit.wikimedia.org/g/mediawiki/core/+/refs/heads/master
Program Files
  • includes/api/ApiFeedContributions.php
Default Status
unaffected
Versions
Affected
  • From * before 1.39.13, 1.42.7 1.43.2, 1.44.0 (semver)
Metrics
VersionBase scoreBase severityVector
4.00.0NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Version: 4.0
Base score: 0.0
Base severity: NONE
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://phabricator.wikimedia.org/T392276
N/A
Hyperlink: https://phabricator.wikimedia.org/T392276
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
3.14.7MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Version: 3.1
Base score: 4.7
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Published At:02 Feb, 2026 | 23:16
Updated At:04 Feb, 2026 | 16:16

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php. This issue affects MediaWiki: from * before 1.39.13, 1.42.7 1.43.2, 1.44.0.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.00.0NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Secondary3.14.7MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Type: Secondary
Version: 4.0
Base score: 0.0
Base severity: NONE
Vector:
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Secondary
Version: 3.1
Base score: 4.7
Base severity: MEDIUM
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
CPE Matches
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://phabricator.wikimedia.org/T392276c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
N/A
Hyperlink: https://phabricator.wikimedia.org/T392276
Source: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

2Records found
CVE-2025-6595
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-Not Assigned
EPSS-0.01% / 0.24%
||
7 Day CHG~0.00%
Published-02 Feb, 2026 | 22:59
Updated-03 Feb, 2026 | 20:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MultimediaViewer.This issue affects MultimediaViewer: from * before 1.39.13, 1.42.7, 1.43.2, 1.44.0.

Action-Not Available
Vendor-Wikimedia Foundation
Product-MultimediaViewer
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-6594
Matching Score-8
Assigner-The Wikimedia Foundation
ShareView Details
Matching Score-8
Assigner-The Wikimedia Foundation
CVSS Score-Not Assigned
EPSS-0.01% / 0.34%
||
7 Day CHG~0.00%
Published-02 Feb, 2026 | 23:00
Updated-03 Feb, 2026 | 20:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
XSS in Special:ApiSandbox

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

Action-Not Available
Vendor-Wikimedia Foundation
Product-MediaWiki
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Details not found