MediaWiki 1.11.0 Release Candidate 1

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:mediawiki:mediawiki:1.11.0:rc1:*:*:*:*:*:*

part: a version: 1.11.0 update: rc1

VendorMediawiki (cdb1ca1d-4622-5407-a7d8-3e891579b8c5)
ProductMediawiki (ab97168e-95e7-5d6e-a2ac-f8d27117dc4d)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/wikimedia/mediawiki purl2cpe 2026-06-01 10:10:57.591903
pkg:wikimedia/mediawiki purl2cpe 2026-06-01 10:10:57.591905

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2014-2853 vulnerable 2026-06-08 05:05:29.965685 Details available
Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
Published: 2014-04-29T18:00:00.000Z
Updated: 2024-08-06T10:28:46.374Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2014-2244 vulnerable 2026-06-08 05:05:28.084821 Details available
Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.
Published: 2014-03-02T02:00:00.000Z
Updated: 2024-08-06T10:06:00.222Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2014-2243 vulnerable 2026-06-08 05:05:28.082250 Details available
includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.
Published: 2014-03-02T02:00:00.000Z
Updated: 2024-08-06T10:06:00.267Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2014-2242 vulnerable 2026-06-08 05:05:28.044302 Details available
includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.
Published: 2014-03-02T02:00:00.000Z
Updated: 2024-08-06T10:06:00.324Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2013-2032 vulnerable 2026-06-08 05:03:57.978065 Details available
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks.
Published: 2013-11-15T18:16:00.000Z
Updated: 2024-08-06T15:20:37.400Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2013-2031 vulnerable 2026-06-08 05:03:57.945456 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-2698 vulnerable 2026-06-08 05:02:05.693536 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-1766 vulnerable 2026-06-08 04:58:02.009321 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-1765 vulnerable 2026-06-08 04:58:01.991430 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-1587 vulnerable 2026-06-08 04:58:00.789594 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-1580 vulnerable 2026-06-08 04:58:00.708523 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-1579 vulnerable 2026-06-08 04:58:00.704937 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-1578 vulnerable 2026-06-08 04:58:00.676918 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-0537 vulnerable 2026-06-08 04:56:37.733218 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-0047 vulnerable 2026-06-08 04:56:33.604343 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2011-0003 vulnerable 2026-06-08 04:56:32.905694 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2010-2788 vulnerable 2026-06-08 04:55:10.630405 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2010-2787 vulnerable 2026-06-08 04:55:10.591635 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2010-1190 vulnerable 2026-06-08 04:54:06.148763 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2010-1189 vulnerable 2026-06-08 04:54:06.146181 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2010-1150 vulnerable 2026-06-08 04:54:05.477860 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.