MediaWiki

An authorization bypass vulnerability in MediaWiki allows attackers to bypass EmailUserAuthorizeSend hooks via the action=emailuser API, potentially enabling unauthorized email transmission if specific security policies are implemented.

Multiple vulnerabilities across various MediaWiki extensions allow remote attackers to perform arbitrary code execution, security bypasses, cross-site scripting, and unauthorized data manipulation or disclosure.

The EmbedVideo MediaWiki extension contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript into wiki pages when the configuration $wgEmbedVideoRequireConsent is disabled.

A vulnerability in the CirrusSearch extension for MediaWiki allows remote, unauthenticated attackers to execute cross-site scripting (XSS) attacks through improper input sanitization.

Multiple vulnerabilities in MediaWiki allow remote, unauthenticated attackers to conduct Cross-Site Scripting (XSS) attacks by exploiting insufficient input validation within the application.

A high-severity stored cross-site scripting (XSS) vulnerability, CVE-2026-52854, exists in the MediaWiki Maps extension (versions prior to 12.1.3), allowing any authenticated user with edit permissions to inject malicious JavaScript into the `overlays` parameter of the `display_map` parser function, leading to arbitrary client-side code execution in a victim's browser.

A remote, authenticated attacker can exploit multiple vulnerabilities in MediaWiki to execute arbitrary code, disclose information, perform a cross-site scripting attack, or cause a denial of service condition.