CVE-2025-43861

ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to reflected or stored XSS in the review dialog. A logged-in attacker must change a form field to include a malicious payload. If that same user then opens the "Review Changes" dialog, the payload will be rendered and executed in the context of their own session. This issue has been patched in commit 2f177dc.

• CWE-79

• https://github.com/miraheze/ManageWiki/commit/2f177dc83b28b727613215b835d4036cb179e4abPatch
• https://github.com/miraheze/ManageWiki/security/advisories/GHSA-859x-46h8-vcrvExploit, Patch, Vendor Advisory

Published

Apr 24, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-43856immich is a high performance self-hosted photo and video man…7.3
• CVE-2025-43857Net::IMAP implements Internet Message Access Protocol (IMAP)…6.5
• CVE-2025-43858YoutubeDLSharp is a wrapper for the command-line video downl…9.2
• CVE-2025-43859h11 is a Python implementation of HTTP/1.1. Prior to version…9.1
• CVE-2025-4386Medtronic MyCareLink Patient Monitor has an internal serial …6.8
• CVE-2025-43860OpenEMR is a free and open source electronic health records …7.6
• CVE-2025-43862Dify is an open-source LLM app development platform. Prior t…7.6
• CVE-2025-43863vantage6 is an open source framework built to enable, manage…9.8
• CVE-2025-43864React Router is a router for React. Starting in version 7.2.…7.5
• CVE-2025-43865React Router is a router for React. In versions on the 7.0 b…8.2
• CVE-2025-43866vantage6 is an open-source infrastructure for privacy preser…7.5
• CVE-2025-4387The Abandoned Cart Pro for WooCommerce plugin contains an au…8.8