CVE-2026-116890 Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API

Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like...

CVE-2026-116890

Semantic MediaWiki versions 3.0.0 through 7.2.x are affected by a missing authorization vulnerability within the api.php smwtask module. This flaw allows unauthenticated attackers to perform admin-only maintenance tasks by utilizing a public anonymous CSRF token. Impacted actions include reading ...

CVE-2026-116880

Semantic MediaWiki versions 3.0.0 through 7.3.1 are vulnerable to a Cross-Site Request Forgery (CSRF) flaw within the Special:SMWAdmin component. The root cause is the software overwriting the wpEditToken with a newly generated valid token. An attacker can trick an authenticated smw-admin user in...

CVE-2026-116880 Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup,...

CVE-2026-116880 Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup,...

CVE-2026-116880 Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup,...

CVE-2026-116874

SemanticMediaWiki versions 3.1.0 before 7.3.1 is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is an unescaped default parameter in the JsonResultPrinter component. An unauthenticated attacker can exploit this by luring victims to a crafted Special:Ask link fe...

CVE-2026-116874 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

CVE-2026-116874

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

CVE-2026-116874 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

CVE-2026-116874 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

EUVD-2026-110702

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unescaped default parameter in JsonResultPrinter. Attackers can lure victims to a crafted Special:Ask link with a zero-result query...

CVE-2026-116875

SemanticMediaWiki versions 3.0.0 before 7.3.1 are vulnerable to a reflected cross-site scripting (XSS) flaw within the Special:Ask functionality. The root cause is the lack of HTML escaping for separator parameters, specifically sep , propsep , valuesep , delim , and separator , when processed by...

CVE-2026-102787

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5...

CVE-2026-102787 Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5...

CVE-2026-102787

The Phoca Download Joomla extension (versions 3.1.0 - 6.1.5 ) is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability within its category management functionality. This vulnerability is associated with CWE-352 . The provided documents do not specify the underlying root cause, practical...

EUVD-2026-110646

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5...

CVE-2026-102787 Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5

Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5...

CVE-2026-116839

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery CSRF vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service DoS attack on the device...

CVE-2026-116838

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery CSRF vulnerability found in airMAX M devices to execute a Command Injection on the device...