6 matches found
CVE-2026-126567
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped nativeresult and scoreset output. Attackers can store markup in a Text property or subobject...
CVE-2026-126567
Semantic MediaWiki versions 3.0.0 before 7.4.1 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the Special:Ask page when using the ElasticStore backend. The flaw is caused by the application failing to escape native_result and score_set outputs. An attacker with edit ri...
CVE-2026-126567 Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via Special:Ask Debug Output
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped nativeresult and scoreset output. Attackers can store markup in a Text property or subobject...
CVE-2026-126567 Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via Special:Ask Debug Output
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped nativeresult and scoreset output. Attackers can store markup in a Text property or subobject...
EUVD-2026-123082
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped nativeresult and scoreset output. Attackers can store markup in a Text property or subobject...
CVE-2026-126567: SemanticMediaWiki: Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the…
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped nativeresult and scoreset output. Attackers can store markup in a Text property or subobject...