EUVD-2025-20663

Malicious code in bioql PyPI...

CVE-2025-7363: Improper Neutralization of Input During Web Page Generation

The TitleIcon extension for MediaWiki is vulnerable to stored XSS through the titleiconunicode parser function. User input passed to this function is wrapped in an HtmlArmor object without sanitization and rendered directly into the page header, allowing attackers to inject arbitrary JavaScript...