PT-2025-50559 · Mediawiki · Tableprogresstracking

Published 2025-12-10 · Updated 2025-12-11 · CVE-2025-67646

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions TableProgressTracking versions 1.2.0 and below

Description TableProgressTracking is a MediaWiki extension used to track progress against specific criteria. Versions 1.2.0 and below do not validate Cross-Site Request Forgery (CSRF) tokens in the REST API. This allows an attacker to create a malicious webpage that, when visited by an authenticated user, can trigger unintended authenticated actions through the victim’s browser. Specifically, an attacker can delete or track progress against tables due to the missing CSRF protection. The issue is addressed in version 1.2.1.

Recommendations Update to TableProgressTracking version 1.2.1 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-67646

GHSA-J24F-HW6W-CQ78

Affected Products

Tableprogresstracking

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67646.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-67646 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-67646 · Security Note
• https://github.com/Telepedia/TableProgressTracking/commit/e2aa8c4b3bb78989c6fe39070a95a26d22b91c94 · Note
• https://github.com/Telepedia/TableProgressTracking/security/advisories/GHSA-j24f-hw6w-cq78 · Note
• https://twitter.com/VulmonFeeds/status/1999099318842675530 · Twitter Post
• https://twitter.com/CVEnew/status/1999108894283776490 · Twitter Post
• https://t.me/CVEtracker/39429 · Telegram Post