CVE-2025-32956

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

ManageWiki is a MediaWiki extension allowing users to manage wikis. Versions before commit f504ed8, are vulnerable to SQL injection when renaming a namespace in Special:ManageWiki/namespaces when using a page prefix (namespace name, which is the current namespace you are renaming) with an injection payload. This issue has been patched in commit f504ed8. A workaround for this vulnerability involves setting `$wgManageWiki['namespaces'] = false;`.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
miraheze	ManageWiki	< f504ed8

References

https://github.com/miraheze/ManageWiki/commit/f504ed8eeb59b57ebb90f93cd44f23da4c5bc4c9Patch
https://github.com/miraheze/ManageWiki/security/advisories/GHSA-gg42-cv66-f5x7Mitigation, Vendor Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-32956-detect-mediawiki-vulnerabilityExploit, Third Party Advisory
https://www.vicarius.io/vsociety/posts/cve-2025-32956-mitigate-mediawiki-vulnerabilityExploit, Mitigation, Third Party Advisory

Timeline

Published: Apr 21, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-329577.2baserCMS is a website development framework. Prior to version 5.2.3, the application's restore function allows users to upload a .zip file, CVE-2025-329589.8Adept is a language for general purpose programming. Prior to commit a1a41b7, the remoteBuild.yml workflow file uses actions/upload-artifact CVE-2025-329596.5CUBA Platform is a high level framework for enterprise applications development. Prior to version 7.2.23, the local file storage implementat CVE-2025-32966.3A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown CVE-2025-329606.4The CUBA REST API add-on performs operations on data and entities. Prior to version 7.2.7, the input parameter, which consists of a file pat CVE-2025-329616.4The Cuba JPA web API enables loading and saving any entities defined in the application data model by sending simple HTTP requests. Prior to CVE-2025-329626.1Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthen CVE-2025-329636.9MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audienc CVE-2025-329644.6ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 00bebea, when enabling a conflicting extension, a restri CVE-2025-329659.3xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2 CVE-2025-329669.8DataEase is an open-source BI tool alternative to Tableau. Prior to version 2.10.8, authenticated users can complete RCE through the backend CVE-2025-329675.4OpenEMR is a free and open source electronic health records and medical practice management application. A logging oversight in versions pri