6 matches found
CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...
EUVD-2026-83173
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...
CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...
GHSA-59XW-QV23-J3RC Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Failure mode The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Remediation - The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Special:SearchByProperty process when user-supplied input in the property and value parameters is reflected into rendered output and error messages without sufficient output-context encoding. An attacker...
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Failure mode The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Remediation - The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into...