Product
Authorization Bypass in MediaWiki RevisionDelete API
An authorization bypass vulnerability in MediaWiki's RevisionDelete API allows users with limited privileges to remove suppression bits, exposing protected content due to improper permission validation.
MediaWiki RESTBase Information Disclosure Vulnerability
1 TTPMediaWiki is susceptible to an information disclosure flaw where the RESTBase-compatible API exposes the numeric user ID of hidden revision authors, allowing unauthenticated attackers to map IDs to usernames.
Multiple Cross-Site Scripting Vulnerabilities in MediaWiki
1 TTPMultiple vulnerabilities in MediaWiki allow remote, unauthenticated attackers to conduct Cross-Site Scripting (XSS) attacks by exploiting insufficient input validation within the application.
MediaWiki Maps Stored XSS via display_map `overlays` Parameter (CVE-2026-52854)
1 rule 2 TTPsA high-severity stored cross-site scripting (XSS) vulnerability, CVE-2026-52854, exists in the MediaWiki Maps extension (versions prior to 12.1.3), allowing any authenticated user with edit permissions to inject malicious JavaScript into the `overlays` parameter of the `display_map` parser function, leading to arbitrary client-side code execution in a victim's browser.
MediaWiki Multiple Vulnerabilities Lead to Remote Code Execution
2 rules 3 TTPsA remote, authenticated attacker can exploit multiple vulnerabilities in MediaWiki to execute arbitrary code, disclose information, perform a cross-site scripting attack, or cause a denial of service condition.