Skip to content
OpenAdvisories
High WID-SEC-2025-2336 16 CVEs

MediaWiki Extensions: Mehrere Schwachstellen

Published Oct 19, 2025 · Updated Oct 22, 2025 · Revision 2 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 16

  • Medium 6.9
    CVE-2025-11937

    Stored XSS through a system message in SecurePoll

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - SecurePoll Extension allows Stored XSS.This issue affects Mediawiki - SecurePoll Extension: master.

    The Wikimedia Foundation Mediawiki - SecurePoll Extension Web / CMS
  • Medium 6.9
    CVE-2025-62662

    Stored XSS through system messages in AdvancedSearch

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - AdvancedSearch Extension allows Stored XSS.This issue affects Mediawiki - AdvancedSearch Extension: from master b…

    The Wikimedia Foundation Mediawiki - AdvancedSearch Extension Web / CMS
  • Medium 6.9
    CVE-2025-62663

    Stored XSS through a system message in UploadWizard

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - UploadWizard Extension allows Stored XSS.This issue affects Mediawiki - UploadWizard Extension: from master befor…

    The Wikimedia Foundation Mediawiki - UploadWizard Extension Web / CMS
  • Medium 6.9
    CVE-2025-62664

    Stored XSS through a system message in ImageRating

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ImageRating Extension allows Stored XSS.This issue affects Mediawiki - ImageRating Extension: from master before …

    The Wikimedia Foundation Mediawiki - ImageRating Extension Web / CMS
  • Medium 6.9
    CVE-2025-62665

    Stored XSS through system messages in Skin:BlueSky

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Skin:BlueSky allows Stored XSS.This issue affects Mediawiki - Skin:BlueSky: from master before 1.39.

    Wikimedia Foundation Mediawiki - Skin:BlueSky Web / CMS
  • Medium 6.9
    CVE-2025-62666

    DoS vector through the cirrusbuilddoc query API

    Allocation of Resources Without Limits or Throttling vulnerability in The Wikimedia Foundation Mediawiki - CirrusSearch Extension allows HTTP DoS.This issue affects Mediawiki - CirrusSearch Extension: from master before 1.43.

    The Wikimedia Foundation Mediawiki - CirrusSearch Extension Web / CMS
  • Medium 6.9
    CVE-2025-62667

    Stored XSS through article extracts in GrowthExperiments

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Stored XSS.This issue affects Mediawiki - GrowthExperiments Extension: from ma…

    The Wikimedia Foundation Mediawiki - GrowthExperiments Extension Web / CMS
  • Medium 6.9
    CVE-2025-62668

    Insufficient permission checks in action=growthsetmentor

    Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments Extension allows Resource Leak Exposure.This issue affects Mediawiki - GrowthExperiments Extension: from master before 1.39.

    The Wikimedia Foundation Mediawiki - GrowthExperiments Extension Web / CMS
  • Medium 6.9
    CVE-2025-62669

    UserInfoCard: activeLocalBlocksAllWikis does not do permissions checks

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth Extension allows Resource Leak Exposure.This issue affects Mediawiki - CentralAuth Extension: from master before 1.39.

    The Wikimedia Foundation MediaWiki CentralAuth extension Web / CMS
  • Medium 6.9
    CVE-2025-62670

    Stored XSS through a system message in FlexDiagrams

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - FlexDiagrams Extension allows Stored XSS.This issue affects Mediawiki - FlexDiagrams Extension: master.

    The Wikimedia Foundation Mediawiki - FlexDiagrams Extension Web / CMS
  • Medium 6.9
    CVE-2025-62671

    Stored XSS through wikitext in Cargo

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: master.

    The Wikimedia Foundation Mediawiki - Cargo extension mediawiki/cargo Web / CMS Packagist
  • Medium 6.5
    CVE-2025-62508

    Citizen vulnerable to stored XSS in sticky header button messages

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function ass…

    StarCitizenTools mediawiki-skins-Citizen starcitizentools/citizen-skin Web / CMS Packagist
  • Medium 5.8
    CVE-2025-62652

    Stored XSS in WebAuthn key name

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki WebAuthn extension allows Stored XSS.This issue affects MediaWiki WebAuthn extension: 1.39, 1.43, 1.44.

    The Wikimedia Foundation MediaWiki WebAuthn extension Web / CMS
  • Low 2.1
    CVE-2025-62655

    SQL injection in Cargo via Special:CargoExport

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows SQL Injection.This issue affects MediaWiki Cargo extension: 1.39, 1.43, 1.44.

    The Wikimedia Foundation Mediawiki - Cargo extension Web / CMS
  • Low 2.0
    CVE-2025-62653

    Stored XSS through system messages in PollNY

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki PollNY extension allows Stored XSS.This issue affects MediaWiki PollNY extension: 1.39, 1.43, 1.44.

    The Wikimedia Foundation MediaWiki PollNY extension Web / CMS
  • Low 2.0
    CVE-2025-62654

    Stored XSS through system messages in QuizGame

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki QuizGame extension allows Stored XSS.This issue affects MediaWiki QuizGame extension: 1.39, 1.43, 1.44.

    The Wikimedia Foundation MediaWiki QuizGame extension Web / CMS

Revision history

  1. #2

    Neue Updates aufgenommen

  2. #1

    Initiale Fassung

References