CVE-2025-21612 Cross-site Scripting in TabberTransclude in Extension:TabberNeue

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2...

CVE-2025-21612

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2...

CVE-2025-21612 Cross-site Scripting in TabberTransclude in Extension:TabberNeue

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2...

TabberNeue 跨站脚本漏洞

TabberNeue is an extension to StarCitizen.tools open source. It allows the Wiki to create tabs on pages. A cross-site scripting vulnerability exists in versions prior to TabberNeue 2.7.2, which stems from TabberTransclude.php not escaping user-supplied page names on output...

PT-2025-4300 · Unknown · Tabberneue

Name of the Vulnerable Software and Affected Versions: TabberNeue versions prior to 2.7.2 Description: The issue arises from unescaped user input being used to construct HTML, allowing any user who can edit pages or render wikitext to perform cross-site scripting XSS attacks on other users...

CVE-2025-21612: Improper Neutralization of Input During Web Page Generation

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2...