SQL Injection

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. Backticks can allow the usage of not-allowed SQL functionsCVE-2024-47849The Wikimedia Foundation · CVSS 8.8 · 0.6% likely

   CWE-89

2. SQLi in Cargo extension via year range filterCVE-2026-58521The Wikimedia Foundation · CVSS 6.9 · 0.6% likely

   CWE-89

3. Cargo Extension: SQLi in Special:DrilldownCVE-2026-14363The Wikimedia Foundation · CVSS 6.9 · 0.5% likely

   CWE-89

4. Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parametersCVE-2026-102796Wikimedia Foundation · CVSS 7.5 · 0.3% likely

   CWE-89

5. SQL injection in Cargo via Special:CargoExportCVE-2025-62655The Wikimedia Foundation · CVSS 2.1 · 0.3% likely

   CWE-89

6. SQL injection in WatchAnalytics through Special:ClearPendingReviewsCVE-2025-62658The Wikimedia Foundation · CVSS 7.5 · 0.2% likely

   CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.