Vulnerabilities in Wikimedia Foundation

136 results
Vexday analysis

Com 118 CVEs catalogadas e nenhuma registrada no catálogo de exploração ativa da CISA (KEV), o perfil de risco da Wikimedia Foundation situa-se abaixo da média geral do catálogo, o que sugere baixa pressão de ameaças imediatas. O tipo de falha mais frequente é CWE-79 (Cross-Site Scripting), padrão comum em plataformas web de grande escala e que requer atenção contínua em processos de sanitização de entrada. As 3 CVEs de severidade crítica e as 17 surgidas nos últimos 90 dias indicam uma superfície em expansão moderada que merece acompanhamento. A CVE mais perigosa atualmente apontada é CVE-2013-4572, com escore EPSS de 0,0214, valor baixo que, somado à ausência de PoCs públicas conhecidas, não sinaliza risco de exploração elevado no curto prazo, mas a antiguidade da vulnerabilidade pode indicar débito técnico pendente de correção.

CVE-2025-23073LOWAPI list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameterEPSS 0.3%CVE-2025-53501HIGHContent Access Bypass in ScribuntoEPSS 0.3%CVE-2025-61649LOWUserInfoCard: Check that performing user has permission to view log entries for number of past blocksEPSS 0.3%CVE-2025-67478NONEWrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"EPSS 0.3%CVE-2025-61654NONEUserInfoCard: Do permission checking when getting counts of global and local edits, new articles and thanksEPSS 0.3%CVE-2025-6595NONEImproper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MultimediaEPSS 0.3%CVE-2025-6594NONEXSS in Special:ApiSandboxEPSS 0.3%CVE-2026-58036LOWUsers API leaks whether privileged users have their user groups disabled for lack of 2FAEPSS 0.3%CVE-2025-52738MEDIUMWordPress Wikipedia Preview plugin <= 1.15.0 - Broken Access Control vulnerabilityEPSS 0.3%CVE-2025-61647LOWUserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rightsEPSS 0.3%CVE-2025-67482LOWLua segfault in unpack()EPSS 0.3%CVE-2025-23072MEDIUMXSS in Special:RefreshSpecialEPSS 0.3%CVE-2025-23080MEDIUMXSSes in Special:BadgeViewEPSS 0.3%CVE-2026-58032MEDIUMmw.Api.getErrorMessage() may return injected HTML if used without errorformat=htmlEPSS 0.3%CVE-2026-34088LOWRecentChanges entries expose suppressed content via generated log page htmlEPSS 0.3%CVE-2026-34091MEDIUMUser localization leaked by AbuseFilter + EventStreamEPSS 0.3%CVE-2025-61634NONEHTML rest endpoint needs PoolCounter and proper parser cache checkEPSS 0.3%CVE-2025-53499CRITICALUnauthorized Inspection of Protected Variables in AbuseFilterEPSS 0.3%CVE-2025-53495CRITICALUnauthorized Disclosure of IP Reputation in AbuseFilterEPSS 0.3%CVE-2025-61641LOWAPI list=allpages with maxsize is making really slow queriesEPSS 0.3%