3007731 matches found
CVE-2026-116890
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like...
CGA-VHF4-3FWH-R3C4
Bulletin has no description...
CGA-HJM9-FQFG-F65G
Bulletin has no description...
CVE-2026-116884
SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data- attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom...
CVE-2026-116885
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into opening a crafted look...
CGA-3QH4-2JRC-33M7
Bulletin has no description...
CGA-M7JJ-26FQ-GXFM
Bulletin has no description...
CVE-2026-116875
SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters sep, propsep, valuesep, delim, separator without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send...
CVE-2026-116873
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types i...
CVE-2026-116879
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subject parameter for a restricted page to trigger forced...
CVE-2025-15260
CVE-2025-15260: Missing Authorization / Broken Access Control in Plugin - MyRewards – Loyalty Points and Rewards for WooCommerce Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. ...
CGA-6W78-FMW6-8H38
Bulletin has no description...
CGA-WGCW-H7P6-7C3H
Bulletin has no description...
CGA-JCH8-XCR3-3GMG
Bulletin has no description...
CGA-F73M-F4P9-X768
Bulletin has no description...
CGA-JCHP-456X-2Q8X
Bulletin has no description...
CGA-2HQF-6G4R-V8CH
Bulletin has no description...
CGA-8HF4-PVFP-6FR2
Bulletin has no description...