Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

All statuses
Filter by:
With package: mediawiki

Found 36 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2025-67480
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
list=allrevisions can be used to bypass Extension:Lockdown

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Api/ApiQueryRevisionsBase.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

Affected products

MediaWiki
  • <1.39.16, 1.43.6, 1.44.3, 1.45.1

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2025-67483
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Page.Preview.Js. This issue affects MediaWiki: from * before 1.43.6, 1.44.3, 1.45.1.

Affected products

MediaWiki
  • <1.43.6, 1.44.3, 1.45.1

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2025-11261
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
Stored i18n XSS exposed by security patch for T402077

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.

Affected products

MediaWiki
  • <1.39.15, 1.43.5, 1.44.2

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2025-67476
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
Importing leaks IP address of importer via EventStreams

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

Affected products

MediaWiki
  • <1.44.3, 1.45.1

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2025-67481
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.JqueryMsg/mediawiki.JqueryMsg.Js. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

Affected products

MediaWiki
  • <1.39.16, 1.43.6, 1.44.3, 1.45.1

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2025-61645
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
CodexTablePager has i18n XSS

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/pager/CodexTablePager.Php. This issue affects MediaWiki: from * before 1.44.1.

Affected products

MediaWiki
  • <1.44.1

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2025-61646
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
Watchlist group mode reveals authors of edits with hidden authorship

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

Affected products

MediaWiki
  • <1.39.14, 1.43.4, 1.44.1

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2025-61644
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
i18n XSS through Special:Watchlist

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/WatchlistTopSectionWidget.Js. This issue affects MediaWiki: from * before > fb856ce9cf121e046305116852cca4899ecb48ca.

Affected products

MediaWiki
  • <> fb856ce9cf121e046305116852cca4899ecb48ca

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2025-67477
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
Stored XSS through a system message in Special:ApiSandbox

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandboxLayout.Js. This issue affects MediaWiki: from * before 1.44.3, 1.45.1.

Affected products

MediaWiki
  • <1.44.3, 1.45.1

Matching in nixpkgs

Package maintainers

Untriaged
Permalink CVE-2025-67475
created 2 months, 2 weeks ago Activity log
  • Created suggestion 2 months, 2 weeks ago
Stored XSS through edit summaries in MW Core

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/CommentFormatter/CommentParser.Php. This issue affects MediaWiki: from * before 1.39.16, 1.43.6, 1.44.3, 1.45.1.

Affected products

MediaWiki
  • <1.39.16, 1.43.6, 1.44.3, 1.45.1

Matching in nixpkgs

Package maintainers