CVE-2025-32956highCWE-89

CVE-2025-32956: falha de alta gravidade em miraheze ManageWiki

ManageWiki has SQL injection vulnerability in NamespaceMigrationJob

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ManageWiki

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8epss 0.7%
ManageWiki is a MediaWiki extension allowing users to manage wikis. Versions before commit f504ed8, are vulnerable to SQL injection when renaming a namespace in Special:ManageWiki/namespaces when using a page prefix (namespace name, which is the current namespace you are renaming) with an injection payload. This issue has been patched in commit f504ed8. A workaround for this vulnerability involves setting `$wgManageWiki['namespaces'] = false;`.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
miraheze · ManageWiki
CVEs relacionadas — miraheze ManageWiki

No mesmo produto, das mais perigosas para as menos.

CVE-2021-29483CRITICALwikiconfig API leaked private config variables set through ManageWikiEPSS 1.2%CVE-2024-25109MEDIUMCross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWikiEPSS 0.4%CVE-2025-43861MEDIUMManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflectionEPSS 0.3%CVE-2025-32964MEDIUMManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensionsEPSS 0.2%