CVE-2025-6593

LowCVSS 2.1/10Last modified Jun 17, 2026

Description

Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php.

This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0.

Metrics

CVSS 4.0 2.1/10CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Feb 2, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-65944.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki.CVE-2025-659422.7VictoriaMetrics is a scalable solution for monitoring and managing time series data. In versions from 1.0.0 to before 1.110.23, from 1.111.0CVE-2025-659445.1Sentry-Javascript is an official Sentry SDKs for JavaScript. From version 10.11.0 to before 10.27.0, when a Node.js application using the SeCVE-2025-659457.5auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an imCVE-2025-659468.1Roo Code is an AI-powered autonomous coding agent that lives in users' editors. Prior to version 3.26.7, Due to an error in validation it waCVE-2025-659478.7thread-amount is a tool that gets the amount of threads in the current process. Prior to version 0.2.2, there are resource leaks when queryiCVE-2025-65954.7Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MultimediaCVE-2025-659508.8WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user CVE-2025-659518.7Inside Track / Entropy Derby is a research-grade horse-racing betting engine. Prior to commit 2d38d2f, the VDF-based timelock encryption sysCVE-2025-659528.7Console is a network used to control Gorilla Tag mods' users and other users on the network. Prior to version 2.8.0, a path traversal vulnerCVE-2025-659536.0NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. Prior to version 0.22.5, a Heap-Use-After-Free (UAF) vulnerability exiCVE-2025-659546.1SimpleSAMLphp-casserver is a CAS 1.0 and 2.0 compliant CAS server in the form of a SimpleSAMLphp module. In versions below 6.3.1 and 7.0.0,
CVE-2025-6593: Low severity, CVSS 2.1 | Vulnix