Skip to content
OpenAdvisories
High WID-SEC-2025-2198 24 CVEs

MediaWiki: Mehrere Schwachstellen

Published Oct 5, 2025 · Updated Feb 1, 2026 · Revision 5 · de-DE

Vendor: Debian Product: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise um Cross-Site-Scripting durchzuführen, vertrauliche Informationen offenzulegen oder die Authentifizierung zu umgehen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 24

  • High 8.8
    CVE-2025-11175

    DiscussionTools should use better regex

    Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundation Mediawiki - DiscussionTools Extension allows Regular Expression Exponential Blowup.This issue affe…

    The Wikimedia Foundation Mediawiki - DiscussionTools Extension mediawiki mediawiki Web / CMS Debian Ubuntu
  • Low 2.7
    CVE-2025-61643

    EventStreams publishes suppressed recent change entries that are suppressed from their creation

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • Low 2.7
    CVE-2025-61652

    Action API discussiontoolspageinfo does not check for authorizeRead for the page

    Vulnerability in Wikimedia Foundation DiscussionTools.This issue affects DiscussionTools: from * before 1.43.4, 1.44.1.

    Wikimedia Foundation DiscussionTools mediawiki mediawiki Debian Ubuntu
  • Low 2.7
    CVE-2025-61653

    Extension:TextExtracts does not check for authorizeRead when returning extracts

    Vulnerability in Wikimedia Foundation TextExtracts. This vulnerability is associated with program files includes/ApiQueryExtracts.Php. This issue affects TextExtracts: from * before 1.39.14, 1.43.4, 1.44.1.

    Wikimedia Foundation TextExtracts mediawiki mediawiki Debian Ubuntu
  • Low 1.7
    CVE-2025-61639

    Suppressed blocked IP is visible in Special:BlockList, RC, and other places

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/ManualLogEntry.Php, includes/recentchanges/RecentChangeFactory.Php, includes/recen…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • Low 1.7
    CVE-2025-61641

    API list=allpages with maxsize is making really slow queries

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • Low 1.3
    CVE-2025-61658

    Special:GlobalContributions shows edits on wikis the viewer doesn't have access to

    Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/GlobalContributions/GlobalContributionsPager.Php. This issue affects CheckUser: from * before 1.43.4, 1.44.1.

    Wikimedia Foundation CheckUser
  • Low 1.2
    CVE-2025-61646

    Watchlist group mode reveals authors of edits with hidden authorship

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-11173

    Reauth for enabling 2FA can be bypassed by submitting a form

    Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated with program files src/Special/OATHManage.Php. This issue affects OATHAuth: from * before 1.39.14, 1.43.4, 1.44.1.

    Wikimedia Foundation OATHAuth mediawiki mediawiki Debian Ubuntu
  • None 0.0
    CVE-2025-11261

    Stored i18n XSS exposed by security patch for T402077

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-61634

    HTML rest endpoint needs PoolCounter and proper parser cache check

    Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-61635

    Add rate limiting to ApiFancyCaptchaReload

    Vulnerability in Wikimedia Foundation ConfirmEdit. This vulnerability is associated with program files includes/FancyCaptcha/ApiFancyCaptchaReload.Php. This issue affects ConfirmEdit: *.

    Wikimedia Foundation ConfirmEdit mediawiki mediawiki Debian Ubuntu
  • None 0.0
    CVE-2025-61636

    Codex Special:Block vulnerable to message key XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php. This issue affects M…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-61637

    Stored XSS through system messages in MW Core

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Action/mediawiki.Action.Edit.Preview.Js, r…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-61638 Public exploit

    Sanitizer::validateAttributes data-XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid. This vulnerability is associated with program files includes/parser/Sanitizer.Php, src/C…

    Wikimedia Foundation MediaWiki Parsoid mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-61640

    Stored XSS through system messages in Special:RecentChangesLinked (MW Core)

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.Js. This is…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-61642

    Stored XSS through system messages provided to CodexHtmlForms

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/CodexHTMLForm.Php, includes/htmlform/fields/HTML…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-61645

    CodexTablePager has i18n XSS

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/pager/CodexTablePager.Php. This issue affects MediaWiki: …

    Wikimedia Foundation MediaWiki mediawiki Web / CMS Ubuntu
  • None 0.0
    CVE-2025-61648

    Stored XSS through system messages in CheckUser

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser.TempAccounts/components/ShowIPButton.Vue, mo…

    Wikimedia Foundation CheckUser
  • None 0.0
    CVE-2025-61651

    i18n XSS through Special:CheckUser CheckUser helper

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files modules/ext.CheckUser/checkuser/checkUserHelper/buildUserElement.J…

    Wikimedia Foundation CheckUser
  • None 0.0
    CVE-2025-61654

    UserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanks

    Vulnerability in Wikimedia Foundation Thanks. This vulnerability is associated with program files includes/ThanksQueryHelper.Php. This issue affects Thanks: from * before 1.43.4, 1.44.1.

    Wikimedia Foundation Thanks mediawiki mediawiki Debian Ubuntu
  • None 0.0
    CVE-2025-61655

    Stored XSS through system messages in VisualEditor

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files includes/ApiVisualEditorEdit.Php, modules/ve-mw/init/targets/ve…

    Wikimedia Foundation VisualEditor mediawiki mediawiki Debian Ubuntu
  • None 0.0
    CVE-2025-61656

    XSS when pasting into VE

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation VisualEditor. This vulnerability is associated with program files src/ce/ve.Ce.ClipboardHandler.Js. This issue affects VisualEdit…

    Wikimedia Foundation VisualEditor mediawiki mediawiki Debian Ubuntu
  • None 0.0
    CVE-2025-61657

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia …

    Wikimedia Foundation Vector mediawiki mediawiki Debian Ubuntu

Revision history

  1. #5

    Referenz(en) aufgenommen: EUVD-2025-206571

  2. #4

    Neue Updates von Debian aufgenommen

  3. #3

    Neue Updates von Debian aufgenommen

  4. #2

    Neue Updates aufgenommen

  5. #1

    Initiale Fassung

References