CVE-2025-49576

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerabilit...

CVE-2025-49576 Citizen allows stored XSS in search no result messages

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerabilit...

CVE-2025-49576

Summary (mode C): CVE-2025-49576 affects the Citizen MediaWiki skin (StarCitizenTools) used in Wikis that employ the Citizen skin. The vulnerability arises because the system messages citizen-search-noresults-title and citizen-search-noresults-desc are inserted into raw HTML, allowing an attacker...

CVE-2025-49579

CVE-2025-49579 affects the Citizen MediaWiki skin. The vulnerability arises because all system messages in Menu.mustache are inserted as raw HTML, enabling stored XSS when a user with editinterface but lacking editsitejs can edit messages. Affected versions are prior to Citizen 3.3.1, with fixed ...

PT-2025-25346 · Mediawiki · Mediawiki Citizen Skin

Name of the Vulnerable Software and Affected Versions: MediaWiki Citizen Skin versions prior to 3.3.1 Description: The issue concerns the Citizen MediaWiki skin, which allows extensions to be part of a cohesive experience. Specifically, the citizen-search-noresults-title and...

GHSA-4C2H-67QQ-VM87 Citizen skin vulnerable to stored XSS through multiple system messages

Summary Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. Details The messages are retrieved using the plain output mode:...

Citizen skin vulnerable to stored XSS through multiple system messages

Summary Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. Details The messages are retrieved using the plain output mode:...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through multiple system messages. An attacker can execute arbitrary scripts in the context of the user's browser by inserting malicious content into editable interface elements. Details Cross-site scripting or X...

CVE-2021-22366

There is an out-of-bounds read vulnerability in eSE620X vESS V100R001C10SPC200, V100R001C20SPC200, V200R001C00SPC300. The vulnerability is due to a function that handles an internal message contains an out-of-bounds read vulnerability. An attacker could crafted messages between system process,...

CVE-2021-44208

OX App Suite through 7.10.5 allows XSS via an unknown system message in Chat...

CVE-2025-25287

Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious system messages, though editing the messages requires high privileges. Those with editinterface...

CVE-2025-25287

CVE-2025-25287 affects the Lakeus skin for MediaWiki. The stored XSS vulnerability arises from improperly handled system messages, with exploitation possible by users having the (editinterface) right; in the case of lakeus-footermessage, all users may be affected if the server links to the reposi...

CVE-2025-25287 Lakeus vulnerable to stored XSS via system messages

Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious system messages, though editing the messages requires high privileges. Those with editinterface...

CVE-2025-25287 Lakeus vulnerable to stored XSS via system messages

Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious system messages, though editing the messages requires high privileges. Those with editinterface...

CVE-2025-25287 Lakeus vulnerable to stored XSS via system messages

Lakeus is a simple skin made for MediaWiki. Starting in version 1.0.8 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious system messages, though editing the messages requires high privileges. Those with editinterface...

mediawiki-skins-Lakeus 跨站脚本漏洞

mediawiki-skins-Lakeus is a MediaWiki skinning plugin by the individual developer lakejason0. A cross-site scripting vulnerability exists in mediawiki-skins-Lakeus, which originates from a stored cross-site script that can be injected via a system message...

PT-2025-42556

Name of the Vulnerable Software and Affected Versions mediawiki affected versions not specified Description The software contains a flaw that allows an attacker to escape three system messages used by live preview. This could potentially lead to unauthorized actions or information disclosure...

PT-2025-42568

Name of the Vulnerable Software and Affected Versions mediawiki affected versions not specified Description The software does not properly escape and parse system messages. This could potentially lead to issues with how system messages are handled. Recommendations At the moment, there is no...

bind9: Parsing large DNS messages may cause excessive CPU load

A flaw was found in the bind package. This issue may allow a remote attacker with no specific privileges to craft a specially long DNS message leading to an excessive and uncontrolled CPU usage, the server being unavailable, and a Denial of Service...

bind9: Parsing large DNS messages may cause excessive CPU load

A flaw was found in the bind package. This issue may allow a remote attacker with no specific privileges to craft a specially long DNS message leading to an excessive and uncontrolled CPU usage, the server being unavailable, and a Denial of Service...