Log in Start free

miraheze

Products

ProductCVEsExploitedLatest
CreateWiki6–Oct 7, 2024
ManageWiki5–Apr 24, 2025
GlobalNewFiles2–Sep 1, 2021
ImportDump2–Oct 9, 2024
WikiDiscover2–Oct 7, 2024
DataDump2–Oct 2, 2024
TSPortal2–Mar 26, 2026
DiscordNotifications1–Jul 10, 2025
IncidentReporting1–Oct 9, 2024

Exploited and recent CVEs

  • CVE-2026-33541 Medium 6.5 TSPortal's Uncontrolled User Creation via Validation Side Effects Leads to Potential Denial of Service 0.3%
  • CVE-2026-29788 High 8.4 TSPortal: Anyone can forge self-deletion requests of any user 0.3%
  • CVE-2025-53371 Critical 9.1 DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs 0.4%
  • CVE-2025-43861 Medium 4.4 ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection 0.3%
  • CVE-2025-32964 Medium 4.6 ManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensions 0.2%
  • CVE-2025-32956 High 8.0 ManageWiki has SQL injection vulnerability in NamespaceMigrationJob 0.7%
  • CVE-2024-47815 Medium 6.0 Cross-site Scripting in IncidentReporting 0.4%
  • CVE-2024-47816 Medium 6.4 Users can impersonate import requesters if their actor IDs coincide in ImportDump 0.3%
  • CVE-2024-47812 Medium 6.0 Cross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDump 0.4%
  • CVE-2024-47781 Medium 5.3 Cross-site Scripting (XSS) in Special:RequestWikiQueue when displaying sitename in CreateWiki 0.3%
  • CVE-2024-47782 High 7.6 Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover 0.3%
  • CVE-2024-47612 Low 3.5 XSS in Special:DataDump when displaying dump status 0.3%
  • CVE-2024-34701 Medium 5.9 CreateWiki vulnerable to impersonation of wiki requester 0.6%
  • CVE-2024-29898 Medium 4.9 Oversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikis 0.7%
  • CVE-2024-29897 Medium 4.9 CreateWiki Leak of suppressed wiki requests outside of `CreateWikiGlobalWiki` 0.7%
  • CVE-2024-29883 Medium 4.9 CreateWiki's wiki request suppression ignores the suppression settings set by the suppressor 0.6%
  • CVE-2024-25109 Medium 6.5 Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki 0.4%
  • CVE-2024-25107 Medium 4.9 Cross-Site Scripting in WikiDiscover 0.4%
  • CVE-2022-24813 Medium 5.3 Authentication Bypass Using an Alternate Path or Channel in CreateWiki 1.0%
  • CVE-2021-39186 Medium 4.3 Improper Input Validation in GlobalNewFiles 1.0%
  • CVE-2021-32774 Medium 6.1 Cross-Site Request Forgery (CSRF) in DataDump 0.5%
  • CVE-2021-32722 Medium 6.5 Uncontrolled Resource Consumption in GlobalNewFiles 1.3%
  • CVE-2021-29483 Critical 9.4 wikiconfig API leaked private config variables set through ManageWiki 1.2%