Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 127

Export CSV
CVE-2018-25065

Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags_body.php cross site scripting

A vulnerability was found in Wikimedia mediawiki-extensions-I18nTags and classified as problematic. This issue affects some unknown processing of the file I18nTags_body.php of the component Unlike Parser. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier of the patch is b4bc3cbbb099eab50cf2b544cf577116f1867b94. It is recommended to apply a patch to fix this issue. The identifier VDB-217445 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-extensions-i18ntags
CVE-2024-47845

CSS sanitizer used incorrectly, and is easily bypassed

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-extensions-css Wikimedia-extensions-css
CVE-2024-47840

Stored XSS through sidebar in Apex skin

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wikimedia
Products
Apex Mediawiki-apex Skin
CVE-2024-47846

Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Cargo Mediawiki-cargo
CVE-2024-47847

Various XSSes found in Cargo

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Cargo Mediawiki-cargo
CVE-2024-47849

Backticks can allow the usage of not-allowed SQL functions

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mediawiki Wikimedia
Products
Cargo Mediawiki-cargo
CVE-2024-47841

Path traversal when loading stylesheets

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.

CVSS 4.0 · 6.9 Medium EPSS 34.6% KEV · Not listed
Vendors
Wikimedia
Products
Mediawiki-extensions-css Wikimedia-extensions-css