CVE-2026-116888

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonicalname. Attackers can save a schema whose canonicalname holds script markup, which...

CVE-2026-116892 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG eve...

CVE-2026-116892

SemanticMediaWiki versions 3.1.0 before 7.3.1 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the extended Special:Search profile where the ProfileForm::profile_sheet component fails to escape markup inserted into a pre element . Unauthenticated attacker...

CVE-2026-116892 SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG eve...

CVE-2026-116888 SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonicalname. Attackers can save a schema whose canonicalname holds script markup, which...

CVE-2026-116883

Semantic MediaWiki versions 3.1.0 before 7.3.1 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue exists because the HtmlBuilder component passes HTML from schema descriptions unescaped to the Html::rawElement() function. Authenticated users with the smw-schemaedit permission c...

CVE-2026-116883 Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

EUVD-2026-110711

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

PT-2026-126349

SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical name. Attackers can save a schema whose canonical name holds script markup, which...

PT-2026-126344

Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement in...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of the data-subtab attribute in elements with the smw-subtab class. An attacker can inject arbitrary HTML and execute JavaScript by crafting malicious wikitext that is parsed and inserted...

CVE-2026-77610: Improper Neutralization of Input During Web Page Generation

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, query debug output format=debug, or the debug request parameter on Special:Ask is assembled by SMW\Query\DebugFormatter and emitted as raw HTML...

CVE-2022-48614

Special:Ask in Semantic MediaWiki before 4.0.2 allows Reflected XSS...

CVE-2012-1212

Cross-site scripting XSS vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMWInitialize.php in Semantic Enterprise Wiki SMW+ 1.5.6, 1.6.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter to...

Cross site scripting

Cross-site scripting XSS vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMWInitialize.php in Semantic Enterprise Wiki SMW+ 1.5.6, 1.6.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter to...

CVE-2012-1212

Cross-site scripting XSS vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMWInitialize.php in Semantic Enterprise Wiki SMW+ 1.5.6, 1.6.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter to...

CVE-2012-1212

CVE-2012-1212 concerns a cross-site scripting (XSS) vulnerability in Semantic Enterprise Wiki (SMW+) via the smwfOnSfSetTargetName path in SMW_Initialize.php. Affected versions are SMW+ 1.5.6 and 1.6.0_2 and earlier; the issue is triggered remotely by supplying a crafted target parameter to index...

CVE-2012-1212: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the smwfOnSfSetTargetName function in extensions/SMWHalo/includes/SMWInitialize.php in Semantic Enterprise Wiki SMW+ 1.5.6, 1.6.02 and earlier allows remote attackers to inject arbitrary web script or HTML via the target parameter to...

PT-2012-3135

Name of the Vulnerable Software and Affected Versions Semantic Enterprise Wiki SMW+ versions 1.5.6, 1.6.0 2 and earlier Description The issue is related to a cross-site scripting XSS vulnerability in the smwfOnSfSetTargetName function. This vulnerability allows remote attackers to inject arbitrar...

SMW+ 1.5.6 - target HTML Injection

SMW+ 1.5.6 - target HTML Injection source: https://www.securityfocus.com/bid/51980/info SMW+ is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input. Attacker-supplied HTML and script code can run in the context of the affected browser,...