20 matches found
CVE-2026-116888
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonicalname. Attackers can save a schema whose canonicalname holds script markup, which...
CVE-2026-116887
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payloa...
CVE-2026-116889
SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders...
CVE-2026-116886
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Brows...
CVE-2026-116889
SemanticMediaWiki versions 2.5.0 through 7.3.1 are vulnerable to a stored cross-site scripting (XSS) vulnerability. The issue exists because the CodeStringValueFormatter renders HTML markup unescaped when processing Code-typed property values containing annotated JSON values. This allows users wi...
CVE-2026-116889 SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property
SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders...
EUVD-2026-110717
SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders...
CVE-2026-116888
SemanticMediaWiki versions 3.2.0 before 7.3.1 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is the unescaped canonical_name property in group schemas, which allows users with the smw-schemaedit right to inject script markup. The GroupFormatter then renders this markup...
CVE-2026-116887 Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payloa...
CVE-2026-116888 SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonicalname. Attackers can save a schema whose canonicalname holds script markup, which...
EUVD-2026-110715
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payloa...
EUVD-2026-110716
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonicalname. Attackers can save a schema whose canonicalname holds script markup, which...
CVE-2026-116887
Semantic MediaWiki versions 3.0.0 before 7.3.1 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue occurs because Keyword-typed property values are rendered unescaped on the Special:Browse page. An attacker with page-edit rights can inject HTML, specifically using an event-handl...
EUVD-2026-110714
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Brows...
CVE-2026-116886 Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Brows...
CVE-2026-116886
Semantic MediaWiki versions 2.5.0 before 7.3.1 are vulnerable to a stored cross-site scripting (XSS) vulnerability. Users with page-edit rights can inject malicious scripts by providing them as External identifier property values. Because the ExternalIdentifierValue function renders these payload...
PT-2026-126347
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Brows...
PT-2026-126350
SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders...
PT-2026-126349
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical name. Attackers can save a schema whose canonical name holds script markup, which...
PT-2026-126348
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payloa...