Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.Js. This issue affects MediaWiki: from * before 1.39.14, 1.43.4, 1.44.1.

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.39.14, 1.43.x prior to 1.43.4 or 1.44.x prior to 1.44.1. It is, therefore, affected by a number of vulnerabilities as follows.

- REST does not set a cache-control value of max-age=60 for redirects. (CVE-2025-61634)

- ApiFancyCaptchaReload does not reuse the badcaptcha rate limit in ConfirmEdit. (CVE-2025-61635)

- Failure to escape rawElement $content. (CVE-2025-61636)

- Failure to escape three system messages used by live preview. (CVE-2025-61637)

- Failure to sanitize data- attributes (also affects Parsoid). (CVE-2025-61638)

- Improper use of ManualLogEntry::getDeleted in ::getRecentChange. (CVE-2025-61639)

- Messages are inserted as HTML instead of being parsed. (CVE-2025-61640)

- maxsize is not disabled in QueryAllPages in miser mode. (CVE-2025-61641)

- Failure to escape the submit button label for Codex-based HTMLForms. (CVE-2025-61642)

- Suppressed recent changes are sent to RCFeeds. (CVE-2025-61643)

- i18n XSS in CodexTablePager. (CVE-2025-61645)

- Hidden usernames are leaked in Watchlist/RecentChanges. (CVE-2025-61646)

- Failure to escape system messages before inserting them as HTML in CheckUser. (CVE-2025-61648)

- XSS in the tempuser-expired-link-tooltip message in CheckUser. (CVE-2025-61651)

- API does not check user read permissions before showing PageInfo in DiscussionTools. (CVE-2025-61652)

- Missing authorizeRead check for the extracts endpoint in TextExtracts. (CVE-2025-61653)

- Deleted entries are not excluded when counting thanks in Thanks. (CVE-2025-61654)

- Improper escaping and parsing of system messages in VisualEditor. (CVE-2025-61655)

- Failure to sanitize attributes unwrapped from data-ve-attributes in VisualEditor. (CVE-2025-61656)

- Sticky header labels are inserted as HTML instead of text in Vector. (CVE-2025-61657)

- Missing config variable to exclude from GlobalContributions in CheckUser. (CVE-2025-61658)

- Reauth for enabling 2FA can be bypassed by submitting a form in OATHAuth. (CVE-2025-11173)

- DiscussionTools uses an insufficient regex. (CVE-2025-11175)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6085 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6085-1                   security@debian.org     https://www.debian.org/security/                       Moritz Muehlenhoff     December 19, 2025                     https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : mediawiki     CVE ID         : CVE-2025-11173 CVE-2025-11261 CVE-2025-61635 CVE-2025-61638                      CVE-2025-61639 CVE-2025-61640 CVE-2025-61641 CVE-2025-61643                      CVE-2025-61646 CVE-2025-61653 CVE-2025-61655 CVE-2025-61656                      CVE-2025-67475 CVE-2025-67478 CVE-2025-67479 CVE-2025-67480                      CVE-2025-67481 CVE-2025-67482 CVE-2025-67484 CVE-2025-67483                      CVE-2025-67477 CVE-2025-61657 CVE-2025-61654 CVE-2025-61652                      CVE-2025-61642 CVE-2025-61637 CVE-2025-61636 CVE-2025-61634                      CVE-2025-11175

    Multiple security issues were discovered in MediaWiki, a website engine for     collaborative work, which could result in cross-site scripting, information     disclosure, missing rate limiting or denial of service.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 1:1.39.17-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 1:1.43.6+dfsg-1~deb13u1.

    We recommend that you upgrade your mediawiki packages.

    For the detailed security status of mediawiki please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mediawiki

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4355 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-4355-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     October 31, 2025                              https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : mediawiki     Version        : 1:1.35.13-1+deb11u5     CVE ID         : CVE-2025-11173 CVE-2025-11261 CVE-2025-61635 CVE-2025-61638                      CVE-2025-61639 CVE-2025-61640 CVE-2025-61641 CVE-2025-61643                      CVE-2025-61646 CVE-2025-61653 CVE-2025-61655 CVE-2025-61656

    Multiple security vulnerabilities were found in mediawiki, a website     engine for collaborative work, that could lead to information     disclosure, denial of service or privilege escalation.

    CVE-2025-11173

        OATHAuth extension: Reauthentication for enabling 2FA can be         bypassed by submitting a form in Special:OATHManage.

    CVE-2025-11261

        Stored i18n Cross-site scripting (XSS) vulnerability in         mw.language.listToText.

    CVE-2025-61635

        ConfirmEdit extension: Missing rate limiting in         ApiFancyCaptchaReload.

    CVE-2025-61638

        Parsoid: Validation bypass for `data-` attributes.

    CVE-2025-61639

        Log entries which are hidden from the creation of the entry may be         disclosed to the public recent change entry.

    CVE-2025-61640

        Stored i18n Cross-site scripting (XSS) vulnerability in         Special:RecentChangesLinked.

    CVE-2025-61641

        DDoS vulnerability in QueryAllPages API in miser mode.  The         `maxsize` value is now ignored in that mode.

    CVE-2025-61643

        Suppressed recent changes may be disclosed to the public RCFeeds.

    CVE-2025-61646

        Public Watchlist/RecentChanges pages may disclose hidden usernames         when an individual editor makes consecutive revisions on a single         page, and only some are marked as hidden username.

    CVE-2025-61653

        TextExtracts extension: Information disclosure vulnerability in the         extracts API action endpoint due to missing read permission check.

    CVE-2025-61655

        VisualEditor extension: Stored i18n Cross-site scripting (XSS)         vulnerability in `lastModifiedAt` system messages.

    CVE-2025-61656

        VisualEditor extension: Missing attribute validation for attributes         unwrapped from `data-ve-attributes`.

    For Debian 11 bullseye, these problems have been fixed in version     1:1.35.13-1+deb11u5.

    We recommend that you upgrade your mediawiki packages.

    For the detailed security status of mediawiki please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/mediawiki

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability     in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files     resources/src/mediawiki.Rcfilters/ui/RclToOrFromWidget.Js. This issue affects MediaWiki: from * before     1.39.14, 1.43.4, 1.44.1. (CVE-2025-61640)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
115337	MediaWiki 1.44.x < 1.44.1 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115336	MediaWiki 1.43.x < 1.43.4 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
115335	MediaWiki < 1.39.14 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
279440	Debian dsa-6085 : mediawiki - security update	Nessus	Debian Local Security Checks	Local	high
272096	Debian dla-4355 : mediawiki - security update	Nessus	Debian Local Security Checks	Local	medium
269504	Linux Distros Unpatched Vulnerability : CVE-2025-61640	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2025-61640

info

Tenable Plugins

high

high

high

high

medium

medium