CVE-2018-25246 HIGH

CVE-2018-25246: Wikipedia 12.0 Denial of Service via Search

Vendor Wikipedia

Product Wikipedia

Weakness CWE-306 · Missing auth

Published April 4, 2026

Last update April 6, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Wikipedia 12.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the application by submitting oversized input through the search functionality. Attackers can paste a large buffer of repeated characters into the search bar to trigger an application crash.

Key dates

02Disclosure timeline

April 4, 2026 CVE published

April 6, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-25246 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html

Related vulnerabilities

04Related CVE

CVE-2025-66445 Authorization bypass vulnerability in Hitachi Infrastructure Analytics Advisor and Hitachi Ops Center Analyzer CVE-2023-0052 SAUTER Controls Nova 200–220 Series Missing Authentication for Critical Function CVE-2026-44775 Kavita: No authentication at /api/Reader/image CVE-2025-48733 DuraComm DP-10iN-100-MU Missing Authentication for Critical Function CVE-2026-2577 Nanobot Unauthenticated WhatsApp Session Hijack via WebSocket Bridge