CVE-2018-25246 HIGH

CVE-2018-25246: Wikipedia 12.0 Denial of Service via Search

Vendor Wikipedia

Product Wikipedia

Weakness CWE-306 · Missing auth

Published April 4, 2026

Last update April 6, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash.

Key dates

02Disclosure timeline

April 4, 2026 CVE published

April 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-25246 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html

Related vulnerabilities

04Related CVE

CVE-2022-0878 Novel attack against the Combined Charging System (CCS) in electric vehicles to remotely cause a denial of service CVE-2026-40050 CrowdStrike LogScale Unauthenticated Path Traversal CVE-2026-22192 Voltronic Power SNMP Web Pro 1.1 Authentication Bypass via localStorage CVE-2024-5947 Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability CVE-2023-27257 Missing Authentication In IDAttend’s IDWeb Application