Vendor
Stored XSS in CommonsMetadata via LicenseUrl
2 TTPs 2 CVEsA stored cross-site scripting (XSS) vulnerability in the CommonsMetadata component, tracked as CVE-2026-103584, allows attackers to inject 'javascript:' URIs into image metadata, leading to unauthorized script execution in the wiki origin.
Stored Cross-Site Scripting in PageForms Extension
1 CVEA stored XSS vulnerability in the PageForms extension allows attackers with page-edit permissions to inject malicious javascript: URIs via the redirect parameter.
Authorization Bypass in MediaWiki RevisionDelete API
An authorization bypass vulnerability in MediaWiki's RevisionDelete API allows users with limited privileges to remove suppression bits, exposing protected content due to improper permission validation.
Reflected Cross-Site Scripting in MediaWiki Cargo Extension
2 TTPs 1 CVEThe Cargo extension for MediaWiki is vulnerable to reflected XSS via unescaped field-alias text in export error messages, allowing unauthenticated attackers to execute arbitrary scripts in the wiki's origin.
MediaWiki Remote Code Execution via PHP Deserialization
1 rule 2 TTPs 2 CVEsMediaWiki is vulnerable to remote code execution (CVE-2026-58025) via insecure PHP deserialization within the LogEntryBase::extractParams method, allowing authenticated sysop users to execute arbitrary code through malicious XML imports.