CVE-2025-53625CWE-359

DynamicPageList3 exposes hidden/suppressed usernames

High · published July 10, 2025

CVSS v4.0
8.7
EPSS
1%
Percentile
42.6
In the wild
Unconfirmed
What it is

The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. The vulnerability is fixed in 3.6.4.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00510 · 42.6th percentile
Weakness
CWE-359 · Exposure of Private Personal Information to an Unauthorized Actor
Published
2025-07-10T18:31Z
EPSS history
Timeline
  • 10 JUL 18:31Z
    DynamicPageList3 exposes hidden/suppressed usernames
    cvelistv5