Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

mediawiki mediawiki 1.26.0 vulnerabilities and exploits

(subscribe to this query)
5
CVSSv2
CVE-2016-6331
ApiParse in MediaWiki prior to 1.23.15, 1.26.x prior to 1.26.4, and 1.27.x prior to 1.27.1 allows remote malicious users to bypass intended per-title read restrictions via a parse action to api.php.
Mediawiki Mediawiki 1.26.2Mediawiki Mediawiki 1.26.3Mediawiki Mediawiki 1.26.4Mediawiki MediawikiMediawiki Mediawiki 1.26.1Mediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.27.0
5
CVSSv2
CVE-2016-6332
MediaWiki prior to 1.23.15, 1.26.x prior to 1.26.4, and 1.27.x prior to 1.27.1, when $wgBlockDisablesLogin is true, might allow remote malicious users to obtain sensitive information by leveraging failure to terminate sessions when a user account is blocked.
Mediawiki Mediawiki 1.27.0Mediawiki Mediawiki 1.26.2Mediawiki Mediawiki 1.26.3Mediawiki Mediawiki 1.26.4Mediawiki MediawikiMediawiki Mediawiki 1.26.1Mediawiki Mediawiki 1.26.0
4.3
CVSSv2
CVE-2016-6334
Cross-site scripting (XSS) vulnerability in the Parser::replaceInternalLinks2 method in MediaWiki prior to 1.23.15, 1.26.x prior to 1.26.4, and 1.27.x prior to 1.27.1 allows remote malicious users to inject arbitrary web script or HTML via vectors involving replacement of percent...
Mediawiki Mediawiki 1.26.3Mediawiki Mediawiki 1.26.4Mediawiki MediawikiMediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.26.1Mediawiki Mediawiki 1.26.2Mediawiki Mediawiki 1.27.0
5
CVSSv2
CVE-2016-6335
MediaWiki prior to 1.23.15, 1.26.x prior to 1.26.4, and 1.27.x prior to 1.27.1 does not generate head items in the context of a given title, which allows remote malicious users to obtain sensitive information via a parse action to api.php.
Mediawiki Mediawiki 1.26.1Mediawiki Mediawiki 1.26.3Mediawiki Mediawiki 1.26.4Mediawiki MediawikiMediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.27.0Mediawiki Mediawiki 1.26.2
4
CVSSv2
CVE-2016-6336
MediaWiki prior to 1.23.15, 1.26.x prior to 1.26.4, and 1.27.x prior to 1.27.1 allows remote authenticated users with undelete permissions to bypass intended suppressrevision and deleterevision restrictions and remove the revision deletion status of arbitrary file revisions by us...
Mediawiki Mediawiki 1.27.0Mediawiki Mediawiki 1.26.4Mediawiki MediawikiMediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.26.2Mediawiki Mediawiki 1.26.1Mediawiki Mediawiki 1.26.3
4.3
CVSSv2
CVE-2016-6333
Cross-site scripting (XSS) vulnerability in the CSS user subpage preview feature in MediaWiki prior to 1.23.15, 1.26.x prior to 1.26.4, and 1.27.x prior to 1.27.1 allows remote malicious users to inject arbitrary web script or HTML via the edit box in Special:MyPage/common.css.
Mediawiki Mediawiki 1.26.2Mediawiki Mediawiki 1.26.3Mediawiki Mediawiki 1.26.4Mediawiki MediawikiMediawiki Mediawiki 1.27.0Mediawiki Mediawiki 1.26.1Mediawiki Mediawiki 1.26.0
6.8
CVSSv2
CVE-2015-8624
The User::matchEditToken function in includes/User.php in MediaWiki prior to 1.23.12, 1.24.x prior to 1.24.5, 1.25.x prior to 1.25.4, and 1.26.x prior to 1.26.1 does not perform token comparison in constant time before determining if a debugging message should be logged, which al...
Mediawiki Mediawiki 1.24.4Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.25.2Mediawiki Mediawiki 1.25.3Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.25.1
5
CVSSv2
CVE-2015-8625
MediaWiki prior to 1.23.12, 1.24.x prior to 1.24.5, 1.25.x prior to 1.25.4, and 1.26.x prior to 1.26.1 do not properly sanitize parameters when calling the cURL library, which allows remote malicious users to read arbitrary files via an @ (at sign) character in unspecified POST a...
Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.2Mediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.25.3Mediawiki MediawikiMediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.4Mediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.2
4.3
CVSSv2
CVE-2015-8622
Cross-site scripting (XSS) vulnerability in MediaWiki prior to 1.23.12, 1.24.x prior to 1.24.5, 1.25.x prior to 1.25.4, and 1.26.x prior to 1.26.1, when is configured with a relative URL, allows remote authenticated users to inject arbitrary web script or HTML via wikitext, as de...
Mediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.24.4Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.3Mediawiki MediawikiMediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.2
5
CVSSv2
CVE-2015-8626
The User::randomPassword function in MediaWiki prior to 1.23.12, 1.24.x prior to 1.24.5, 1.25.x prior to 1.25.4, and 1.26.x prior to 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, which makes it easier for remote malicious users to obtain access via a brute-for...
Mediawiki MediawikiMediawiki Mediawiki 1.24.0Mediawiki Mediawiki 1.24.1Mediawiki Mediawiki 1.24.2Mediawiki Mediawiki 1.26.0Mediawiki Mediawiki 1.24.4Mediawiki Mediawiki 1.24.3Mediawiki Mediawiki 1.25.1Mediawiki Mediawiki 1.25.3Mediawiki Mediawiki 1.25.0Mediawiki Mediawiki 1.25.2
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
authentication bypassCVE-2024-30051remoteCVE-2024-27954CVE-2023-51483CVE-2023-47782SSRFCVE-2024-24715CVE-2023-52424
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook