Cross-site Scripting (XSS)

mediawiki is vulnerable to cross-site scripting XSS. The attack is possible because it allows the creation of a page that does not correspond to any user, e.g User:Foo/bar.js. Subsequently, an attacker will be able to create an account User:Foo and create a malicious script bar.js, which causes t...