EUVD-2022-4110

Malicious code in bioql PyPI...

Cross-Site Scripting (XSS)

MediaWiki is vulnerable to cross-site scripting. The non-jqueryMsg version of mw.message.parse doesn't escape HTML...

UBUNTU-CVE-2020-25828

An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message.parse doesn't escape HTML. This affects both message contents which are generally safe and the parameters which can be based on user input. When jqueryMsg is loaded...

Non-jqueryMsg version of mw.message(…).parse() doesn't escape HTML

More info at https://phabricator.wikimedia.org/T115888...