Back to Database
Status published
Low
CVE-2025-62655
SQL injection in Cargo via Special:CargoExport
Vulnerability Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki Cargo extension allows SQL Injection.This issue affects MediaWiki Cargo extension: 1.39, 1.43, 1.44.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62655
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- SomeRandomDeveloper
References
More from The Wikimedia Foundation
View All →CVE-2025-62702
Stored XSS through system messages
Medium
6.9
CVE-2025-62701
Stored XSS through system messages
Medium
6.9
CVE-2025-62700
Stored XSS through a system message in MultiBoilerplate
Medium
6.9
CVE-2025-62699
Special:Translate tool does not use the correct IP and User-Agent in the CheckUser tool
Medium
6.9
CVE-2025-62698
Stored XSS through system messages in ExternalGuidance
Medium
6.9
Affected Vendor
The Wikimedia Foundation
View all reports →Affected Software
MediaWiki Cargo extension
Vulnerable Versions:
1.39, 1.43, 1.44
Timeline
Official Publish:
October 17th, 2025
Last Modified:
October 20th, 2025
Added to House:
July 22nd, 2026