Advisories · Technology
The Wikimedia Foundation MediaWiki WikiLambda extension.
Every CVE that names The Wikimedia Foundation MediaWiki WikiLambda extension among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.4 High
WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments
- The Wikimedia Foundation MediaWiki WikiLambda extension
- Broken access control
- CVSS 6.1 Medium
WikifunctionsFragmentRenderer does unsafe string replacements on user-provided HTML
- The Wikimedia Foundation Mediawiki - WikiLambda Extension
- Cross-site scripting (XSS)
- CVSS 2.9 Low
WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions
- The Wikimedia Foundation Mediawiki - WikiLambda Extension
- CWE-280
- CVSS 6.9 Medium
Blocked users can create and edit WikiLambda objects
- The Wikimedia Foundation Mediawiki - WikiLambda Extension
- Authentication bypass
- CVSS 6.9 Medium
Stored XSS through system messages
- The Wikimedia Foundation Mediawiki - WikiLambda Extension
- Cross-site scripting (XSS)