PT-2025-29121 · Mediawiki · Dynamicpagelist3

Markus-Rost · Published 2025-07-10 · Updated 2025-07-11 · CVE-2025-53625

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: DynamicPageList3 extension versions prior to 3.6.4

Description: The DynamicPageList3 extension for MediaWiki contains an issue where certain parameters can reveal usernames that have been hidden through revision deletion, suppression, or the hideuser block flag. Specifically, the parameters adduser, addauthor, addlasteditor, and addcontribution output usernames using placeholders like %USER% and %CONTRIBUTOR%, even when those usernames have been hidden. Additionally, parameters like lastrevisionbefore, allrevisionsbefore, firstrevisionsince, and allrevisionssince can expose suppressed usernames when used with user-related output placeholders. Parameters such as createdby, notcreatedby, modifiedby, notmodifiedby, lastmodifiedby, and notlastmodifiedby can indirectly reveal hidden usernames when used in queries.

Recommendations: DynamicPageList3 extension versions prior to 3.6.4 should be updated to version 3.6.4 or later.

Exploit

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2025-53625

GHSA-7PGW-Q3QP-6PGQ

Affected Products

Dynamicpagelist3

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53625.json · Exploit
• 🔥 https://github.com/Universal-Omega/DynamicPageList3/security/advisories/GHSA-7pgw-q3qp-6pgq · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53625 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53625 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7pgw-q3qp-6pgq · Vendor Advisory
• https://github.com/Universal-Omega/DynamicPageList3/commit/a3dae0c89fb4214390c29ceffa23bbe2099986d6 · Note
• https://github.com/Universal-Omega/DynamicPageList3 · Note
• https://twitter.com/CveFindCom/status/1943387328325566548 · Twitter Post
• https://twitter.com/CVEnew/status/1943700224616075740 · Twitter Post