Miraheze vulnerabilities
We track 3 vulnerabilities in Miraheze products across 3 products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on March 6, 2026.
Latest Miraheze vulnerabilities
- 7.5 High severity
TSPortal: Unverified Ownership
TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-
- 9.1 Critical severity
DiscordNotifications: Uncontrolled Resource Consumption
DiscordNotifications is an extension for MediaWiki that sends notifications of actions in your Wiki to a Discord channel. DiscordNotifications allows sending requests via curl and file_get_contents to arbitrary URLs set via $wgDiscordIncomingWebhookUrl and $wg
- 8.0 High severity
ManageWiki: Improper Neutralization of Special Elements used in an SQL Command
ManageWiki is a MediaWiki extension allowing users to manage wikis. Versions before commit f504ed8, are vulnerable to SQL injection when renaming a namespace in Special:ManageWiki/namespaces when using a page prefix (namespace name, which is the current namesp