# cve.now: Wikimedia Foundation

The newest entries naming Wikimedia Foundation as an affected vendor (up to 200), of 152 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-102796](https://cve.now/CVE-2026-102796.md): Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters (CVSS 7.5)
- [CVE-2026-100245](https://cve.now/CVE-2026-100245.md): Stored XSS on Wikibase Special:SetSiteLink via unescaped system message (CVSS 6.1)
- [CVE-2026-100244](https://cve.now/CVE-2026-100244.md): CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669) (CVSS 7.5)
- [CVE-2026-100243](https://cve.now/CVE-2026-100243.md): Stored XSS in WikiSEO author and image properties on action=info (CVSS 6.1)
- [CVE-2026-100242](https://cve.now/CVE-2026-100242.md): DataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion) (CVSS 7.5)
- [CVE-2026-100241](https://cve.now/CVE-2026-100241.md): Private change tags exposed to anonymous users via revision-tags-change events (CVSS 7.5)
- [CVE-2026-100240](https://cve.now/CVE-2026-100240.md): TemplateSandbox does not check read permissions for the page being previewed (CVSS 9.1)
- [CVE-2026-100238](https://cve.now/CVE-2026-100238.md): Flow colon-separator and flow-guidedtour-optin-welcome-description messages allow stored XSS (CVSS 6.1)
- [CVE-2026-100383](https://cve.now/CVE-2026-100383.md): Stored i18n XSS in WikiLambda's VisualEditor integration (CVSS 4.8)
- [CVE-2026-100382](https://cve.now/CVE-2026-100382.md): Unauthenticated remote code execution through wikitext in ExternalData (CVSS 10.0)
- [CVE-2026-100381](https://cve.now/CVE-2026-100381.md): UploadWizard Flickr collection and set titles allow DOM XSS (CVSS 5.3)
- [CVE-2026-100380](https://cve.now/CVE-2026-100380.md): Reflected XSS in Wikibase Special:SetLabel language validation (CVSS 5.3)
- [CVE-2026-100379](https://cve.now/CVE-2026-100379.md): Cross-request disclosure of CentralAuth cookies in Wikipedia Android App (CVSS 5.3)
- [CVE-2026-100378](https://cve.now/CVE-2026-100378.md): Missing permission check in the Translate sandbox doRemind action (CVSS 5.3)
- [CVE-2026-100376](https://cve.now/CVE-2026-100376.md): TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix (CVSS 4.8)
- [CVE-2026-100377](https://cve.now/CVE-2026-100377.md): Revision-deleted pages can be viewed through WikiLambda's action=edit and Special:ViewAbstract (CVSS 6.9)
- [CVE-2026-58025](https://cve.now/CVE-2026-58025.md): Remote Code Execution via Unsafe Deserialization in LogItem Import (CVSS 5.9)
- [CVE-2026-58029](https://cve.now/CVE-2026-58029.md): Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata (CVSS 5.3)
- [CVE-2026-58028](https://cve.now/CVE-2026-58028.md): Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets (CVSS 0.0)
- [CVE-2026-58026](https://cve.now/CVE-2026-58026.md): $wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces (CVSS 0.0)
- [CVE-2026-8857](https://cve.now/CVE-2026-8857.md): Full RCE using EasyTimeline Extension (CVSS 0.0)
- [CVE-2026-58038](https://cve.now/CVE-2026-58038.md): Stored XSS through javascript URLs in SVGs generated by EasyTimeline (CVSS 0.0)
- [CVE-2026-58027](https://cve.now/CVE-2026-58027.md): QueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UI (CVSS 5.3)
- [CVE-2026-58030](https://cve.now/CVE-2026-58030.md): SyntaxHighlight stored XSS via unsanitized 'linelinks' attribute (CVSS 5.3)
- [CVE-2026-58032](https://cve.now/CVE-2026-58032.md): mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html (CVSS 5.3)
- [CVE-2026-58033](https://cve.now/CVE-2026-58033.md): "Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted (CVSS 5.3)
- [CVE-2026-58037](https://cve.now/CVE-2026-58037.md): Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input (CVSS 0.0)
- [CVE-2026-58036](https://cve.now/CVE-2026-58036.md): Users API leaks whether privileged users have their user groups disabled for lack of 2FA (CVSS 2.1)
- [CVE-2026-58024](https://cve.now/CVE-2026-58024.md): API identification of users on private wikis (CVSS 5.1)
- [CVE-2026-13707](https://cve.now/CVE-2026-13707.md): Session fixation attacks on improperly configured OAuth 1.0a tools (CVSS 0.0)
- [CVE-2026-13706](https://cve.now/CVE-2026-13706.md): UrlShortener extension url validation can be bypassed due to difference between php url parsing and WHATWG (CVSS 0.0)
- [CVE-2026-58031](https://cve.now/CVE-2026-58031.md): Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected (CVSS 0.0)
- [CVE-2026-58034](https://cve.now/CVE-2026-58034.md): Stored XSS through a system message when blocking a temporary account that's related to other temporary accounts (CVSS 0.0)
- [CVE-2026-58035](https://cve.now/CVE-2026-58035.md): Stored XSS through a system message in the codex version of Special:Block (CVSS 0.0)
- [CVE-2026-5266](https://cve.now/CVE-2026-5266.md): Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. (CVSS 2.3)
- [CVE-2026-34095](https://cve.now/CVE-2026-34095.md): action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request (CVSS 0.0)
- [CVE-2026-34094](https://cve.now/CVE-2026-34094.md): Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix (CVSS 2.0)
- [CVE-2026-34093](https://cve.now/CVE-2026-34093.md): Special:UserRights allows viewing user rights from private wiki (CVSS 1.1)
- [CVE-2026-34092](https://cve.now/CVE-2026-34092.md): Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP (CVSS 2.1)
- [CVE-2026-34091](https://cve.now/CVE-2026-34091.md): User localization leaked by AbuseFilter + EventStream (CVSS 5.5)
- [CVE-2026-34090](https://cve.now/CVE-2026-34090.md): Suggested investigations: Handle suppressed usernames (CVSS 4.8)
- [CVE-2026-34089](https://cve.now/CVE-2026-34089.md): Memory leak in Scribunto causes runJobs.php to run out of memory (CVSS 2.3)
- [CVE-2026-34088](https://cve.now/CVE-2026-34088.md): RecentChanges entries expose suppressed content via generated log page html (CVSS 1.3)
- [CVE-2026-34087](https://cve.now/CVE-2026-34087.md): Users API leaks whether privileged users have their user groups disabled for lack of 2FA (CVSS 5.1)
- [CVE-2026-34086](https://cve.now/CVE-2026-34086.md): AbuseFilter misuses ::userCanBitfield, exposing access-controlled information (CVSS 2.1)
- [CVE-2026-39837](https://cve.now/CVE-2026-39837.md): Stored XSS through the dynamic table format in Cargo (CVSS 6.3)
- [CVE-2026-39841](https://cve.now/CVE-2026-39841.md): Stored XSS through list fields on Cargo's page values and Special:CargoTables (CVSS 6.3)
- [CVE-2026-39840](https://cve.now/CVE-2026-39840.md): CSS injection in multiple Cargo display formats (CVSS 5.1)
- [CVE-2026-39839](https://cve.now/CVE-2026-39839.md): Stored XSS through URLs in Cargo's map format (CVSS 6.3)
- [CVE-2026-39838](https://cve.now/CVE-2026-39838.md): ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS (CVSS 6.9)
- [CVE-2026-5762](https://cve.now/CVE-2026-5762.md): ReportIncident DiscussionTools integration causes slow requests (CVSS 5.3)
- [CVE-2025-67481](https://cve.now/CVE-2025-67481.md): mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does (CVSS 0.0)
- [CVE-2025-67482](https://cve.now/CVE-2025-67482.md): Lua segfault in unpack() (CVSS 1.7)
- [CVE-2025-67483](https://cve.now/CVE-2025-67483.md): Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels (CVSS 0.0)
- [CVE-2025-67484](https://cve.now/CVE-2025-67484.md): Action API xslt option allows JavaScript execution by administrators who are not interface administrators (CVSS 0.0)
- [CVE-2025-67480](https://cve.now/CVE-2025-67480.md): list=allrevisions can be used to bypass Extension:Lockdown (CVSS 0.0)
- [CVE-2025-67475](https://cve.now/CVE-2025-67475.md): Stored XSS through edit summaries in MW Core (CVSS 0.0)
- [CVE-2025-67476](https://cve.now/CVE-2025-67476.md): Importing leaks IP address of importer via EventStreams (CVSS 1.3)
- [CVE-2025-67477](https://cve.now/CVE-2025-67477.md): Stored XSS through a system message in Special:ApiSandbox (CVSS 0.0)
- [CVE-2025-67478](https://cve.now/CVE-2025-67478.md): Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn" (CVSS 0.0)
- [CVE-2025-67479](https://cve.now/CVE-2025-67479.md): Magic word replacement in legacy parser allows using reserved data attributes through wikitext (CVSS 0.0)
- [CVE-2025-61654](https://cve.now/CVE-2025-61654.md): UserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanks (CVSS 0.0)
- [CVE-2025-61655](https://cve.now/CVE-2025-61655.md): Stored XSS through system messages in VisualEditor (CVSS 0.0)
- [CVE-2025-61656](https://cve.now/CVE-2025-61656.md): XSS when pasting into VE (CVSS 0.0)
- [CVE-2025-61657](https://cve.now/CVE-2025-61657.md): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. (CVSS 0.0)
- [CVE-2025-61658](https://cve.now/CVE-2025-61658.md): Special:GlobalContributions shows edits on wikis the viewer doesn't have access to (CVSS 1.3)
- [CVE-2025-61653](https://cve.now/CVE-2025-61653.md): Extension:TextExtracts does not check for authorizeRead when returning extracts (CVSS 2.7)
- [CVE-2025-61652](https://cve.now/CVE-2025-61652.md): Action API discussiontoolspageinfo does not check for authorizeRead for the page (CVSS 2.7)
- [CVE-2025-61651](https://cve.now/CVE-2025-61651.md): i18n XSS through Special:CheckUser CheckUser helper (CVSS 0.0)
- [CVE-2025-11173](https://cve.now/CVE-2025-11173.md): Reauth for enabling 2FA can be bypassed by submitting a form (CVSS 0.0)
- [CVE-2025-11261](https://cve.now/CVE-2025-11261.md): Stored i18n XSS exposed by security patch for T402077 (CVSS 0.0)
- [CVE-2025-61648](https://cve.now/CVE-2025-61648.md): Stored XSS through system messages in CheckUser (CVSS 0.0)
- [CVE-2025-61649](https://cve.now/CVE-2025-61649.md): UserInfoCard: Check that performing user has permission to view log entries for number of past blocks (CVSS 1.1)
- [CVE-2025-61650](https://cve.now/CVE-2025-61650.md): UserInfoCard is vulnerable to message key stored XSS (CVSS 1.1)
- [CVE-2025-61645](https://cve.now/CVE-2025-61645.md): CodexTablePager has i18n XSS (CVSS 0.0)
- [CVE-2025-61646](https://cve.now/CVE-2025-61646.md): Watchlist group mode reveals authors of edits with hidden authorship (CVSS 1.2)
- [CVE-2025-61647](https://cve.now/CVE-2025-61647.md): UserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rights (CVSS 0.3)
- [CVE-2025-61644](https://cve.now/CVE-2025-61644.md): i18n XSS through Special:Watchlist (CVSS 0.0)
- [CVE-2025-61637](https://cve.now/CVE-2025-61637.md): Stored XSS through system messages in MW Core (CVSS 0.0)
- [CVE-2025-61638](https://cve.now/CVE-2025-61638.md): Sanitizer::validateAttributes data-XSS (CVSS 0.0)
- [CVE-2025-61639](https://cve.now/CVE-2025-61639.md): Suppressed blocked IP is visible in Special:BlockList, RC, and other places (CVSS 1.7)
- [CVE-2025-61640](https://cve.now/CVE-2025-61640.md): Stored XSS through system messages in Special:RecentChangesLinked (MW Core) (CVSS 0.0)
- [CVE-2025-61641](https://cve.now/CVE-2025-61641.md): API list=allpages with maxsize is making really slow queries (CVSS 1.7)
- [CVE-2025-61642](https://cve.now/CVE-2025-61642.md): Stored XSS through system messages provided to CodexHtmlForms (CVSS 0.0)
- [CVE-2025-61643](https://cve.now/CVE-2025-61643.md): EventStreams publishes suppressed recent change entries that are suppressed from their creation (CVSS 2.7)
- [CVE-2025-61634](https://cve.now/CVE-2025-61634.md): HTML rest endpoint needs PoolCounter and proper parser cache check (CVSS 0.0)
- [CVE-2025-61635](https://cve.now/CVE-2025-61635.md): Add rate limiting to ApiFancyCaptchaReload (CVSS 0.0)
- [CVE-2025-61636](https://cve.now/CVE-2025-61636.md): Codex Special:Block vulnerable to message key XSS (CVSS 0.0)
- [CVE-2025-6589](https://cve.now/CVE-2025-6589.md): With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList (CVSS 2.1)
- [CVE-2025-6590](https://cve.now/CVE-2025-6590.md): Complete content leak of private wikis due to PasswordReset Wikitext injection in error message (CVSS 4.6)
- [CVE-2025-6591](https://cve.now/CVE-2025-6591.md): HTML injection in API action=feedcontributions output from i18n message (CVSS 0.0)
- [CVE-2025-6592](https://cve.now/CVE-2025-6592.md): Creating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLog (CVSS 2.1)
- [CVE-2025-6593](https://cve.now/CVE-2025-6593.md): "{{SITENAME}} registered email address has been changed" email sent to unverified email addresses (CVSS 2.1)
- [CVE-2025-6594](https://cve.now/CVE-2025-6594.md): XSS in Special:ApiSandbox (CVSS 0.0)
- [CVE-2025-6595](https://cve.now/CVE-2025-6595.md): Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Multimedia (CVSS 0.0)
- [CVE-2025-6596](https://cve.now/CVE-2025-6596.md): Vector inserts portlet labels as HTML, allowing for stored XSS through system messages (CVSS 0.0)
- [CVE-2025-6597](https://cve.now/CVE-2025-6597.md): MediaWiki should not consider autocreation as login for the purposes of security reauthentication (CVSS 0.0)
- [CVE-2025-6927](https://cve.now/CVE-2025-6927.md): Autoblocks from global account suppressions are publicly visible (CVSS 2.3)
- [CVE-2026-0817](https://cve.now/CVE-2026-0817.md): CampaignEvents API missing authorization exposes meeting and chat URLs (CVSS 5.3)
- [CVE-2026-0671](https://cve.now/CVE-2026-0671.md): Multiple stored i18n/message-key XSSes in UploadWizard (CVSS 6.1)
- [CVE-2026-0670](https://cve.now/CVE-2026-0670.md): Stored XSS through a system message and a user-provided parameter in ProofreadPage (CVSS 6.1)
- [CVE-2026-0669](https://cve.now/CVE-2026-0669.md): Path Traversal vulnerability in CSS extension on certain web servers (CVSS 7.5)
- [CVE-2026-0668](https://cve.now/CVE-2026-0668.md): VisualData extension: Regular Expression Denial of Service (ReDoS) via crafted user input (CVSS 5.3)
- [CVE-2025-52738](https://cve.now/CVE-2025-52738.md): WordPress Wikipedia Preview plugin \<= 1.15.0 - Broken Access Control vulnerability (CVSS 6.5)
- [CVE-2025-62665](https://cve.now/CVE-2025-62665.md): Stored XSS through system messages in Skin:BlueSky (CVSS 6.9)
- [CVE-2025-7363](https://cve.now/CVE-2025-7363.md): TitleIcon: Stored Cross-Site Scripting (XSS) via #titleicon\_unicode parser function (CVSS 5.4)
- [CVE-2025-7362](https://cve.now/CVE-2025-7362.md): MsUpload: Stored Cross-Site Scripting (XSS) via unsanitized msu-continue system message (CVSS 5.4)
- [CVE-2025-53479](https://cve.now/CVE-2025-53479.md): CheckUser: Reflected Cross-Site Scripting (XSS) in Special:CheckUser via unsanitized internationalized message (CVSS 5.4)
- [CVE-2025-53480](https://cve.now/CVE-2025-53480.md): CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messages (CVSS 5.4)
- [CVE-2025-53496](https://cve.now/CVE-2025-53496.md): Stored XSS in MediaSearch (CVSS 5.4)
- [CVE-2025-53488](https://cve.now/CVE-2025-53488.md): Stored XSS in WikiHiero (CVSS 6.1)
- [CVE-2025-53498](https://cve.now/CVE-2025-53498.md): Lack of Audit Logging in AbuseFilter (CVSS 5.3)
- [CVE-2025-53499](https://cve.now/CVE-2025-53499.md): Unauthorized Inspection of Protected Variables in AbuseFilter (CVSS 9.1)
- [CVE-2025-53495](https://cve.now/CVE-2025-53495.md): Unauthorized Disclosure of IP Reputation in AbuseFilter (CVSS 9.1)
- [CVE-2025-53478](https://cve.now/CVE-2025-53478.md): CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messages (CVSS 5.4)
- [CVE-2025-53497](https://cve.now/CVE-2025-53497.md): Stored XSS in RelatedArticles (CVSS 5.4)
- [CVE-2025-53491](https://cve.now/CVE-2025-53491.md): XSS in FlaggedRevs (CVSS 5.4)
- [CVE-2025-53487](https://cve.now/CVE-2025-53487.md): ApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messages (CVSS 5.4)
- [CVE-2025-7057](https://cve.now/CVE-2025-7057.md): Stored XSS in Quiz (CVSS 5.4)
- [CVE-2025-53486](https://cve.now/CVE-2025-53486.md): WikiCategoryTagCloud: Reflected Cross-Site Scripting (XSS) via linkstyle attribute in parser function (CVSS 5.4)
- [CVE-2025-7056](https://cve.now/CVE-2025-7056.md): Stored XSS in UrlShortener (CVSS 6.3)
- [CVE-2025-53485](https://cve.now/CVE-2025-53485.md): SecurePoll: Unauthorized access to SetTranslationHandler allows arbitrary text changes (CVSS 7.5)
- [CVE-2025-53484](https://cve.now/CVE-2025-53484.md): SecurePoll: Multiple locations vulnerable to Cross-Site Scripting (XSS) via unescaped input (CVSS 9.8)
- [CVE-2025-53483](https://cve.now/CVE-2025-53483.md): SecurePoll: Multiple admin actions vulnerable to Cross-Site Request Forgery (CVSS 8.8)
- [CVE-2025-53482](https://cve.now/CVE-2025-53482.md): IPInfo: Message key XSS through several IPInfo messages in infobox and popup (CVSS 6.1)
- [CVE-2025-53481](https://cve.now/CVE-2025-53481.md): Denial of service vector on ipinfo/v0/norevision (CVSS 7.5)
- [CVE-2025-6926](https://cve.now/CVE-2025-6926.md): Security Authentication Bypass in CentralAuth (CVSS 8.8)
- [CVE-2025-53500](https://cve.now/CVE-2025-53500.md): Stored XSS in MassEditRegex (CVSS 5.6)
- [CVE-2025-53501](https://cve.now/CVE-2025-53501.md): Content Access Bypass in Scribunto (CVSS 8.8)
- [CVE-2025-53502](https://cve.now/CVE-2025-53502.md): HTML injection in FeaturedFeeds (CVSS 6.5)
- [CVE-2025-53489](https://cve.now/CVE-2025-53489.md): XSS in GoogleDocs4MW (CVSS 5.6)
- [CVE-2025-53490](https://cve.now/CVE-2025-53490.md): Multiple XSS in CampaignEvents (CVSS 5.6)
- [CVE-2025-53492](https://cve.now/CVE-2025-53492.md): Stored XSS in MintyDocs (CVSS 3.7)
- [CVE-2025-53493](https://cve.now/CVE-2025-53493.md): Stored XSS in MintyDocs (CVSS 6.5)
- [CVE-2025-53494](https://cve.now/CVE-2025-53494.md): Stored XSS in TwoColConflict (CVSS 6.5)
- [CVE-2025-32700](https://cve.now/CVE-2025-32700.md): AbuseFilter log interfaces expose global private and hidden filters when central DB is not available (CVSS 2.3)
- [CVE-2025-32699](https://cve.now/CVE-2025-32699.md): Potential javascript injection attack enabled by Unicode normalization in Action API (CVSS 2.1)
- [CVE-2025-32698](https://cve.now/CVE-2025-32698.md): LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions (CVSS 2.1)
- [CVE-2025-32697](https://cve.now/CVE-2025-32697.md): Cascading protection is not preventing file reversions (CVSS 0.0)
- [CVE-2025-32696](https://cve.now/CVE-2025-32696.md): "reupload-own" restriction can be bypassed by reverting file (CVSS 0.0)
- [CVE-2025-3469](https://cve.now/CVE-2025-3469.md): i18n XSS vulnerability in HTMLMultiSelectField when sections are used (CVSS 0.0)
- [CVE-2025-23074](https://cve.now/CVE-2025-23074.md): Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed) (CVSS 2.4)
- [CVE-2025-23073](https://cve.now/CVE-2025-23073.md): API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter (CVSS 3.5)
- [CVE-2025-23072](https://cve.now/CVE-2025-23072.md): XSS in Special:RefreshSpecial (CVSS 5.4)
- [CVE-2025-23081](https://cve.now/CVE-2025-23081.md): Various security vulnerabilities in Extension:DataTransfer (CVSS 6.1)
- [CVE-2025-23080](https://cve.now/CVE-2025-23080.md): XSSes in Special:BadgeView (CVSS 5.3)
- [CVE-2025-23079](https://cve.now/CVE-2025-23079.md): XSSes in Extension:ArticleFeedbackv5 (CVSS 6.1)
- [CVE-2025-23078](https://cve.now/CVE-2025-23078.md): XSS in BreadCrumbs2 (CVSS 6.5)
- [CVE-2013-4572](https://cve.now/CVE-2013-4572.md): The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cac (no CVSS)
- [CVE-2013-6451](https://cve.now/CVE-2013-6451.md): Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote atta (no CVSS)
- [CVE-2013-6455](https://cve.now/CVE-2013-6455.md): The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usern (no CVSS)
- [CVE-2013-4303](https://cve.now/CVE-2013-4303.md): includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/wikimedia-foundation
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.