Threats affecting pkg:composer/mediawiki/mediawiki

7 threats

Severity	CVSS	Signals	Threat	Source	Published
Medium	5.9	EPSS 0.5%	CVE-2026-58025Wikimedia Foundation MediaWiki · Deserialization of Untrusted Data Medium5.9EPSS 0.5%2026-07-01CVE Database V5CVE-2026-58025 Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/WikiImporter.Php, includes/Import/WikiRevision.Php, includes/Logging/LogEntryBase.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. EPSS 0.5%Vulnerability CWE-502	CVE Database V5	2026-07-01
High	–	EPSS 0.3%	CVE-2026-58037Wikimedia Foundation MediaWiki · XSS or 'Cross-site Scripting' HighEPSS 0.3%2026-07-01CVE Database V5CVE-2026-58037 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Language/Language.Php, includes/Logging/BlockLogFormatter.Php, includes/Logging/LogFormatter.Php, includes/Logging/PatrolLogFormatter.Php, includes/Logging/RenameuserLogFormatter.Php, includes/Logging/TagLogFormatter.Php, includes/Specials/SpecialVersion.Php. This issue affects MediaWiki: from * before 1.46.0, 1.45.4, 1.44.6, 1.43.9. EPSS 0.3%Vulnerability CWE-79	CVE Database V5	2026-07-01
Low	1.3	EPSS 0.3%	CVE-2025-67476Wikimedia Foundation MediaWiki Low1.3EPSS 0.3%2026-02-03CVE Database V5CVE-2025-67476 Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Import/ImportableOldRevisionImporter.Php. This issue affects MediaWiki: from * before 1.44.3, 1.45.1. EPSS 0.3%Vulnerability	CVE Database V5	2026-02-03
Low	1.2	EPSS 0.3%	CVE-2025-61646Wikimedia Foundation MediaWiki · Path Traversal Low1.2EPSS 0.3%2026-02-03CVE Database V5CVE-2025-61646 Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1. EPSS 0.3%Vulnerability CWE-22	CVE Database V5	2026-02-03
High	7.4	EPSS 0.7%	CVE-2024-34507mediawiki · Basic XSS High7.4EPSS 0.7%2024-05-05CVE Database V5CVE-2024-34507 An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occur because of mishandling of the 0x1b character, as demonstrated by Special:RecentChanges#%1b0000000. EPSS 0.7%Vulnerability CWE-80	CVE Database V5	2024-05-05
Medium	–	EPSS 0.7%	CVE-2023-51704mediawiki · CVE-2023-51704 is a cross-site scripting (XSS) MediumEPSS 0.7%2023-12-22CVE Database V5CVE-2023-51704 CVE-2023-51704 is a cross-site scripting (XSS) vulnerability in MediaWiki affecting certain versions prior to 1.35.14, between 1.36.0 and before 1.39.6, and between 1.40.0 and before 1.40.2. The issue arises in the RightsLogFormatter.php component, where group-*-member messages can lead to XSS on the Special:log/rights page. Fixed versions are 1.35.14, 1.39.6, and 1.40.2. EPSS 0.7%Vulnerability	CVE Database V5	2023-12-22
Medium	–	EPSS 0.8%	CVE-2023-45362mediawiki · CVE-2023-45362 is an information leak MediumEPSS 0.8%2023-11-03CVE Database V5CVE-2023-45362 CVE-2023-45362 is an information leak vulnerability in MediaWiki's DifferenceEngine.php component. It affects versions prior to 1.35.12, versions from 1.36.0 up to but excluding 1.39.5, and versions from 1.40.0 up to but excluding 1.40.1. The flaw causes intermediate revisions by the same user to ignore username suppression, potentially exposing user information that should be hidden. EPSS 0.8%Vulnerability	CVE Database V5	2023-11-03

Page 1 of 1