31 matches found
CVE-2026-116882
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...
CVE-2026-116883
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...
CVE-2026-116883
Semantic MediaWiki versions 3.1.0 before 7.3.1 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue exists because the HtmlBuilder component passes HTML from schema descriptions unescaped to the Html::rawElement() function. Authenticated users with the smw-schemaedit permission c...
EUVD-2026-110711
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...
CVE-2026-116883 Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...
CVE-2026-116883 Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...
CVE-2026-116882 Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...
CVE-2026-116882 Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...
EUVD-2026-110710
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...
CVE-2026-116882
Semantic MediaWiki versions 4.2.0 through 7.3.1 are vulnerable to a stored cross-site scripting (XSS) vulnerability. Authenticated profile or schema editors can inject HTML by storing malicious markup in FacetedSearch exploration-link labels . The root cause is that the ExploreListBuilder::buildH...
CVE-2026-116882 Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...
Semantic MediaWiki cross-site scripting vulnerability
Semantic MediaWiki versions from 3.1.0 up to and including 7.3.1 contain a cross-site scripting vulnerability. This vulnerability arises because authenticated schema editors with smw-schemaedit privileges can inject HTML via schema descriptions. The unescaped HTML is then passed to Html::rawEleme...
Semantic MediaWiki cross-site scripting vulnerability
Semantic MediaWiki versions from 4.2.0 up to but including 7.3.1 contain a cross-site scripting vulnerability. This vulnerability arises because authenticated configuration or architecture editors can inject HTML via the FacetedSearch exploration-link tag. The ExploreListBuilder::buildHTML functi...
PT-2026-126343
Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...
PT-2026-126344
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...
EUVD-2020-23146
Malware in sbrugna...
CVE-2020-27620
The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups...
MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability
An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.42.0. XSS can occur through an interface message. Error messages in the $err var are not escaped before being passed to Html::rawElement in the getError function in the Hooks class...
CVE-2024-34500
An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages in the $err var are not escaped before being passed to Html::rawElement in the getError function in the...
CVE-2024-34500
An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages in the $err var are not escaped before being passed to Html::rawElement in the getError function in the...