High severity · published Oct 20, 2025
CVE-2025-62658
SQL injection in WatchAnalytics through Special:ClearPendingReviews
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation MediaWiki WatchAnalytics extension allows SQL Injection.This issue affects MediaWiki WatchAnalytics extension: 1.43, 1.44.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MW
MediaWiki WatchAnalytics extension · The Wikimedia Foundation
1.43; 1.44 · source: vendor
Affected product
MW
MediaWiki WatchAnalytics extension
The Wikimedia Foundation