GCVE - cpe:2.3:a:mediawiki:mediawiki:1.18.3:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mediawiki:mediawiki:1.18.3:*:*:*:*:*:*:*

part: a version: 1.18.3 update: *

Vendor	Mediawiki (`cdb1ca1d-4622-5407-a7d8-3e891579b8c5`)
Product	Mediawiki (`ab97168e-95e7-5d6e-a2ac-f8d27117dc4d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/wikimedia/mediawiki`	purl2cpe	2026-06-01 10:10:57.618121
`pkg:wikimedia/mediawiki`	purl2cpe	2026-06-01 10:10:57.618122

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-2853`	vulnerable	2026-06-03 14:33:51.991763	Details available Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action. Published: 2014-04-29T18:00:00.000Z Updated: 2024-08-06T10:28:46.374Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/67068 http://www.securitytracker.com/id/1030161 http://secunia.com/advisories/58262 https://github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6 http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-April/000149.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2244`	vulnerable	2026-06-03 14:33:50.161663	Details available Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php. Published: 2014-03-02T02:00:00.000Z Updated: 2024-08-06T10:06:00.222Z Open on db.gcve.eu Reference links http://openwall.com/lists/oss-security/2014/02/28/1 http://www.securityfocus.com/bid/65906 http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb%2Cn%2Cz https://bugzilla.wikimedia.org/show_bug.cgi?id=61362	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2243`	vulnerable	2026-06-03 14:33:50.159301	Details available includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses. Published: 2014-03-02T02:00:00.000Z Updated: 2024-08-06T10:06:00.267Z Open on db.gcve.eu Reference links http://openwall.com/lists/oss-security/2014/02/28/1 https://bugzilla.wikimedia.org/show_bug.cgi?id=61346 http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html https://bugzilla.redhat.com/show_bug.cgi?id=1071136 http://openwall.com/lists/oss-security/2014/03/01/2	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2242`	vulnerable	2026-06-03 14:33:50.147293	Details available includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element. Published: 2014-03-02T02:00:00.000Z Updated: 2024-08-06T10:06:00.324Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/65910 http://openwall.com/lists/oss-security/2014/02/28/1 https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb%2Cn%2Cz http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html https://bugzilla.wikimedia.org/show_bug.cgi?id=60771	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2032`	vulnerable	2026-06-03 14:32:53.316011	Details available MediaWiki before 1.19.6 and 1.20.x before 1.20.5 does not allow extensions to prevent password changes without using both Special:PasswordReset and Special:ChangePassword, which allows remote attackers to bypass the intended restrictions of an extension that only implements one of these blocks. Published: 2013-11-15T18:16:00.000Z Updated: 2024-08-06T15:20:37.400Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html http://secunia.com/advisories/55433 http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106293.html http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105784.html http://security.gentoo.org/glsa/glsa-201310-21.xml	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-2031`	vulnerable	2026-06-03 14:32:53.308310	Details available MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox. Published: 2013-11-15T18:16:00.000Z Updated: 2024-08-06T15:20:37.509Z Open on db.gcve.eu Reference links http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105825.html http://secunia.com/advisories/57472 https://bugzilla.wikimedia.org/show_bug.cgi?id=47304 http://secunia.com/advisories/55433 http://www.debian.org/security/2014/dsa-2891	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5395`	vulnerable	2026-06-03 14:32:29.284194	Details available Session fixation vulnerability in the CentralAuth extension for MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the centralauth_Session cookie. Published: 2014-06-02T15:00:00.000Z Updated: 2024-08-06T21:05:47.249Z Open on db.gcve.eu Reference links https://bugzilla.wikimedia.org/show_bug.cgi?id=40962 http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-November/000122.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-5391`	vulnerable	2026-06-03 14:32:29.269284	Details available Session fixation vulnerability in Special:UserLogin in MediaWiki before 1.18.6, 1.19.x before 1.19.3, and 1.20.x before 1.20.1 allows remote attackers to hijack web sessions via the session_id. Published: 2014-06-02T15:00:00.000Z Updated: 2024-08-06T21:05:47.225Z Open on db.gcve.eu Reference links https://exchange.xforce.ibmcloud.com/vulnerabilities/83008 http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-November/000122.html http://lists.fedoraproject.org/pipermail/package-announce/2013-March/100843.html http://lists.fedoraproject.org/pipermail/package-announce/2013-March/100845.html http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098975.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-2698`	vulnerable	2026-06-03 14:31:54.362933	Details available Cross-site scripting (XSS) vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Main_page. Published: 2012-06-29T19:00:00.000Z Updated: 2024-08-06T19:42:31.984Z Open on db.gcve.eu Reference links http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000116.html https://www.mediawiki.org/wiki/Release_notes/1.18 http://www.osvdb.org/82983 http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-June/000117.html http://secunia.com/advisories/49484	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.