CVE-2026-116875

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters sep, propsep, valuesep, delim, separator without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send...

CVE-2026-116875 SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters sep, propsep, valuesep, delim, separator without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send...

CVE-2026-116875

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters sep, propsep, valuesep, delim, separator without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send...

CVE-2026-116875 SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters sep, propsep, valuesep, delim, separator without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send...

CVE-2026-116875

SemanticMediaWiki versions 3.0.0 before 7.3.1 are vulnerable to a reflected cross-site scripting (XSS) flaw within the Special:Ask functionality. The root cause is the lack of HTML escaping for separator parameters, specifically sep , propsep , valuesep , delim , and separator , when processed by...

EUVD-2026-110703

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters sep, propsep, valuesep, delim, separator without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send...

CVE-2026-116871

Semantic MediaWiki versions 3.0.0 before 7.3.1 are vulnerable to an uncontrolled recursion vulnerability within the LegacyParser::getSubqueryDescription() component. The flaw occurs because nested query tokens are processed before depth limits are applied. An unauthenticated attacker can exploit ...

PT-2026-126336

SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters sep, propsep, valuesep, delim, separator without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send...

CVE-2026-77610

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, query debug output format=debug, or the debug request parameter on Special:Ask is assembled by SMW\Query\DebugFormatter and emitted as raw HTML...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Special:Ask process when a forged cursor pagination token is supplied. An attacker can execute arbitrary scripts in the victim's browser by crafting a malicious link containing a specially crafted cursor...

GHSA-CX86-7XWP-W9WF Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Reflected XSS via a forged cursor pagination token Failure mode Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an unsigned base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the...

Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Reflected XSS via a forged cursor pagination token Failure mode Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an unsigned base64url-encoded JSON blob, so its contents are fully attacker-controlled. When the...

CVE-2026-77616 Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an...

EUVD-2026-83189

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an...

CVE-2026-77616

Semantic MediaWiki versions 7.0.0–7.1.0 are affected by a reflected XSS in the Special:Ask page. The cursor query parameter (introduced for keyset pagination in 7.0.0) is an unsigned base64url-encoded JSON blob, making its contents fully attacker-controlled. When the cursor's sort anchor mismatch...

CVE-2026-77616 Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an...

CVE-2026-77616 Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. In versions 7.0.0 through 7.1.0, Special:Ask accepts a cursor query parameter for keyset pagination added in 7.0.0. The token is decoded by CursorEncoder, which is an...

CVE-2026-77610 Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, query debug output format=debug, or the debug request parameter on Special:Ask is assembled by SMW\Query\DebugFormatter and emitted as raw HTML...

CVE-2026-77610 Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, query debug output format=debug, or the debug request parameter on Special:Ask is assembled by SMW\Query\DebugFormatter and emitted as raw HTML...

GHSA-Q5FM-9MX6-44F4 Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

Query debug output XSS Failure mode Semantic MediaWiki's query debug output format=debug, or the debug request parameter on Special:Ask is assembled by SMW\Query\DebugFormatter and emitted as raw HTML. Several of its sinks apply no output-context encoding, so attacker-controlled query input is...