The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Cargo extension of the software platform for implementing the MediaWiki hypertext environment is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attack...

CVE-2026-103049

A flaw was found in the MediaWiki Cargo extension. This vulnerability allows a remote attacker to conduct a reflected Cross-Site Scripting XSS attack due to improper input sanitization of table headers on the Special:CargoQuery page. By enticing a user to follow a specially crafted link, an...

EUVD-2026-89502

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

CVE-2026-103049

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

CVE-2026-103049: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

CVE-2026-103049 XSS in Cargo's Special:CargoQuery page due to unsanitized table headers

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

CVE-2026-103049 XSS in Cargo's Special:CargoQuery page due to unsanitized table headers

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: before 1.46.1...

CVE-2026-103049

The MediaWiki Cargo extension (versions before 1.46.1 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the improper sanitization of table headers on the Special:CargoQuery page. A remote attacker can exploit this by enticing a user to click a specially crafted lin...

PT-2026-102942

Name of the Vulnerable Software and Affected Versions Mediawiki - Cargo extension versions prior to 1.46.1 Description Improper neutralization of input during web page generation leads to a Reflected Cross-Site Scripting XSS issue. This occurs when an application includes untrusted data in a web...

CVE-2026-96877

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96878

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96876

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96875

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96878

The Mediawiki - Cargo extension is vulnerable to Reflected XSS due to improper neutralization of input during web page generation. This security flaw affects versions through 3.9.4 . While the primary description identifies it as Reflected XSS, a related record mentions the Cargo Exhibit field al...

CVE-2026-96878 Cargo Exhibit field alias allows stored XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

EUVD-2026-87319

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96878 Cargo Exhibit field alias allows stored XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96877

The Mediawiki - Cargo extension is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. This issue specifically affects versions through 3.9.4 and occurs via the Cargo Drilldown full-text search functionality. While the docu...

EUVD-2026-87318

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...

CVE-2026-96877 Reflected XSS through Cargo Drilldown full-text search

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Mediawiki - Cargo extension allows Reflected XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4...