Vulnerabilidades en Wikimedia Foundation
152 resultadosCVE-2025-6591NONEHTML injection in API action=feedcontributions output from i18n messageEPSS 0.4%CVE-2025-32698LOWLogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictionsEPSS 0.4%CVE-2025-32700LOWAbuseFilter log interfaces expose global private and hidden filters when central DB is not availableEPSS 0.4%CVE-2025-6596NONEVector inserts portlet labels as HTML, allowing for stored XSS through system messagesEPSS 0.4%CVE-2026-100381MEDIUMUploadWizard Flickr collection and set titles allow DOM XSSEPSS 0.4%CVE-2026-100380MEDIUMReflected XSS in Wikibase Special:SetLabel language validationEPSS 0.4%CVE-2026-58033MEDIUM"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deletedEPSS 0.4%CVE-2025-32699LOWPotential javascript injection attack enabled by Unicode normalization in Action APIEPSS 0.4%CVE-2026-100242HIGHDataTransfer depends on phpspreadsheet version vulnerable to CVE-2026-59933 (XLS/OLE memory exhaustion)EPSS 0.4%CVE-2025-6592LOWCreating a permanent account from a temporary account associates temp username and IP address with real username in AbuseLogEPSS 0.4%CVE-2025-32697NONECascading protection is not preventing file reversionsEPSS 0.4%CVE-2025-11173NONEReauth for enabling 2FA can be bypassed by submitting a formEPSS 0.4%CVE-2025-61635NONEAdd rate limiting to ApiFancyCaptchaReloadEPSS 0.4%CVE-2025-61653LOWExtension:TextExtracts does not check for authorizeRead when returning extractsEPSS 0.4%CVE-2026-100379MEDIUMCross-request disclosure of CentralAuth cookies in Wikipedia Android AppEPSS 0.4%CVE-2025-53501HIGHContent Access Bypass in ScribuntoEPSS 0.4%CVE-2026-39838MEDIUMProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSSEPSS 0.4%CVE-2025-61649LOWUserInfoCard: Check that performing user has permission to view log entries for number of past blocksEPSS 0.4%CVE-2026-58027MEDIUMQueryAbuseFilter API can be used to see the hit count of private filters, which is hidden in the UIEPSS 0.4%CVE-2026-58024MEDIUMAPI identification of users on private wikisEPSS 0.4%