PT-2025-42818 · WordPress+1 · Watchanalytics+1

Somerandomdeveloper · Published 2025-10-20 · Updated 2025-10-21 · CVE-2025-62658

Positive Technologies (AI Summary)

CVSS v4.0

7.5

High

Base vector

AV:N/AC:H/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Name of the Vulnerable Software and Affected Versions MediaWiki WatchAnalytics extension versions 1.43 through 1.44

Description A flaw exists in the MediaWiki WatchAnalytics extension that allows for SQL Injection. The issue is due to improper neutralization of special elements within SQL commands. This could potentially allow an attacker to manipulate database queries.

Recommendations Update to a newer version of the MediaWiki WatchAnalytics extension that addresses this issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2025-62658

Affected Products

Mediawiki

Watchanalytics

References · 9

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-62658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62658 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-62658 · Security Note
• https://ubuntu.com/security/CVE-2025-62658 · Vendor Advisory
• https://phabricator.wikimedia.org/T406380 · Note
• https://t.me/CVEtracker/35357 · Telegram Post
• https://t.me/cveNotify/139538 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1980442358660419696 · Twitter Post
• https://twitter.com/CVEnew/status/1980374104654983274 · Twitter Post