CVE-2026-116883

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

CVE-2026-116882

Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...

EUVD-2026-110711

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

CVE-2026-116883 Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

CVE-2026-116883 Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

CVE-2026-116883

Semantic MediaWiki versions 3.1.0 before 7.3.1 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue exists because the HtmlBuilder component passes HTML from schema descriptions unescaped to the Html::rawElement() function. Authenticated users with the smw-schemaedit permission c...

CVE-2026-116882 Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels

Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...

CVE-2026-116882 Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels

Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...

EUVD-2026-110710

Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...

CVE-2026-116882 Semantic MediaWiki 4.2.0 before 7.3.1 Stored XSS via FacetedSearch Exploration Labels

Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...

CVE-2026-116882

Semantic MediaWiki versions 4.2.0 through 7.3.1 are vulnerable to a stored cross-site scripting (XSS) vulnerability. Authenticated profile or schema editors can inject HTML by storing malicious markup in FacetedSearch exploration-link labels . The root cause is that the ExploreListBuilder::buildH...

Semantic MediaWiki cross-site scripting vulnerability

Semantic MediaWiki versions from 3.1.0 up to and including 7.3.1 contain a cross-site scripting vulnerability. This vulnerability arises because authenticated schema editors with smw-schemaedit privileges can inject HTML via schema descriptions. The unescaped HTML is then passed to Html::rawEleme...

Semantic MediaWiki cross-site scripting vulnerability

Semantic MediaWiki versions from 4.2.0 up to but including 7.3.1 contain a cross-site scripting vulnerability. This vulnerability arises because authenticated configuration or architecture editors can inject HTML via the FacetedSearch exploration-link tag. The ExploreListBuilder::buildHTML functi...

PT-2026-126344

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

PT-2026-126343

Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema editors to inject HTML through FacetedSearch exploration-link labels. Attackers can store markup in the label, which ExploreListBuilder::buildHTML passes...

CVE-2025-61636

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLButtonField.Php. This issue affects MediaWiki: from before 1.39.14, 1.43.4,...

EUVD-2020-23146

Malware in sbrugna...

Cross Site Scripting (XSS)

ckeditor5 is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of malicious content inserted into the editor when specific configurations are enabled such as the HTML embed plugin or custom plugins with editable RawElement views, which allows an attacker to...

CVE-2025-58064: Improper Neutralization of Input During Web Page Generation

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting XSS vulnerability. Ability to exploit could be triggered by a specific user action leading to...

CVE-2025-58064 CKEditor is susceptible to Cross-Site Scripting (XSS) through its clipboard package

CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. ckeditor5 and ckeditor5-clipboard versions 46.0.0 through 46.0.2 and 44.2.0 through 45.2.1 contain a Cross-Site Scripting XSS vulnerability. Ability to exploit could be triggered by a specific user action leading to...