CVE-2026-126563

Semantic MediaWiki versions 2.4.0 before 7.4.1 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the TimeValueFormatter::getCaptionFromFreeFormat() function, which fails to escape HTML when emitting free-format date captions. An unauthenticated attacker ca...

EUVD-2026-123078

Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat, which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout...

CVE-2026-126563: SemanticMediaWiki: Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in…

Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat, which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout...

PT-2026-144947

Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueFormatter::getCaptionFromFreeFormat, which emits free-format date captions in HTML without escaping. Unauthenticated attackers can craft a Special:Ask URL with HTML markup in a date printout...