Exposição de MediaWiki

Wikis
56
score de exposição
15.723
sites usam
0
em exploração
0
críticos
Análise Vexday

Com 64 CVEs catalogadas e nenhuma em exploração ativa confirmada pelo CISA KEV, o MediaWiki apresenta taxa de exploração abaixo da média geral do catálogo, o que sugere menor pressão imediata de ameaças práticas. A ausência de vulnerabilidades de severidade crítica reforça um perfil de risco moderado, embora a presença de 6 CVEs surgidas nos últimos 90 dias indique atividade contínua de descoberta que merece acompanhamento. O tipo de falha mais recorrente é CWE-79 (Cross-Site Scripting), historicamente associado a riscos de injeção de conteúdo e sequestro de sessão em aplicações web colaborativas. A CVE mais perigosa em destaque, CVE-2012-4381, apresenta EPSS de aproximadamente 0,04, valor baixo que, combinado com a ausência de registros KEV, sugere exploração improvável no curto prazo — ainda assim, vulnerabilidades antigas sem correção aplicada merecem verificação em ambientes legados.

CVEs

75 resultados
CVE-2017-0363—Special:UserLogin?returnto=interwiki:foo will redirect to external sitesEPSS 1.1%CVE-2013-6451—Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attaEPSS 1.1%CVE-2017-0362—"Mark all pages visited" on the watchlist does not require a CSRF tokenEPSS 0.8%CVE-2017-0361—api.log contains passwords in plaintextEPSS 0.5%CVE-2025-6927LOWAutoblocks from global account suppressions are publicly visibleEPSS 0.5%CVE-2025-6597NONEMediaWiki should not consider autocreation as login for the purposes of security reauthenticationEPSS 0.5%CVE-2025-6589LOWWith MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockListEPSS 0.4%CVE-2025-6593LOW"{{SITENAME}} registered email address has been changed" email sent to unverified email addressesEPSS 0.4%CVE-2025-67484NONEAction API xslt option allows JavaScript execution by administrators who are not interface administratorsEPSS 0.4%CVE-2025-6591NONEHTML injection in API action=feedcontributions output from i18n messageEPSS 0.4%CVE-2025-3469NONEi18n XSS vulnerability in HTMLMultiSelectField when sections are usedEPSS 0.4%CVE-2025-32698LOWLogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictionsEPSS 0.4%CVE-2025-32700LOWAbuseFilter log interfaces expose global private and hidden filters when central DB is not availableEPSS 0.4%CVE-2025-32697NONECascading protection is not preventing file reversionsEPSS 0.4%CVE-2025-32699LOWPotential javascript injection attack enabled by Unicode normalization in Action APIEPSS 0.4%CVE-2026-58025MEDIUMRemote Code Execution via Unsafe Deserialization in LogItem ImportEPSS 0.3%CVE-2025-6590MEDIUMComplete content leak of private wikis due to PasswordReset Wikitext injection in error messageEPSS 0.3%CVE-2025-32696NONE"reupload-own" restriction can be bypassed by reverting fileEPSS 0.3%CVE-2026-34091MEDIUMUser localization leaked by AbuseFilter + EventStreamEPSS 0.3%CVE-2026-34088LOWRecentChanges entries expose suppressed content via generated log page htmlEPSS 0.3%