Back to Database
Status published
High
CVE-2025-62658
SQL injection in WatchAnalytics through Special:ClearPendingReviews
Vulnerability Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extension allows SQL Injection.This issue affects MediaWiki WatchAnalytics extension: 1.43, 1.44.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-62658
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- SomeRandomDeveloper
References
More from The Wikimedia Foundation
View All →CVE-2025-62702
Stored XSS through system messages
Medium
6.9
CVE-2025-62701
Stored XSS through system messages
Medium
6.9
CVE-2025-62700
Stored XSS through a system message in MultiBoilerplate
Medium
6.9
CVE-2025-62699
Special:Translate tool does not use the correct IP and User-Agent in the CheckUser tool
Medium
6.9
CVE-2025-62698
Stored XSS through system messages in ExternalGuidance
Medium
6.9
Affected Vendor
The Wikimedia Foundation
View all reports →Affected Software
MediaWiki WatchAnalytics extension
Vulnerable Versions:
1.43, 1.44
Timeline
Official Publish:
October 20th, 2025
Last Modified:
October 21st, 2025
Added to House:
July 22nd, 2026