CVE-2024-23176

A flaw was found in the MassMessage extension of MediaWiki. This vulnerability, known as Cross-Site Scripting XSS, allows a remote attacker to inject malicious scripts into web pages viewed by other users. The flaw occurs when a specially crafted URL, specifically Special:MassMessage?uselang=x-xs...

CVE-2024-23176

An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS...

PT-2026-91064

Name of the Vulnerable Software and Affected Versions MassMessage extension in MediaWiki versions prior to 1.40.2 Description A Cross-Site Scripting XSS issue exists in the MassMessage extension. The problem occurs when using the Special:MassMessage endpoint with the uselang parameter set to a...

CVE-2024-23176

An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS...

EUVD-2025-20666

Malicious code in bioql PyPI...

CVE-2025-53480: Improper Neutralization of Input During Web Page Generation

The CheckUser extension’s Special:Investigate page has a vulnerability in the Account information tab, where specific internationalized messages are rendered without proper escaping. Attackers can exploit this by appending ?uselang=x-xss to the URL, causing reflected XSS when the UI renders...

CVE-2025-53479: Improper Neutralization of Input During Web Page Generation

The CheckUser extension’s Special:CheckUser interface is vulnerable to reflected XSS via the rev-deleted-user message. This message is rendered without proper escaping, making it possible to inject JavaScript through the uselang=x-xss language override mechanism. This issue affects Mediawiki -...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the uselang parameter, which allows system messages to be inserted into raw HTML without proper escaping. An attacker can execute arbitrary JavaScript in the context of the user's browser by injecting crafte...

CVE-2025-53487: Improper Neutralization of Input During Web Page Generation

The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper escaping. Attackers can exploit this by injecting JavaScript payloads via the uselang=x-xss language override, which causes crafted message ke...

PT-2024-2681

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.40.2 GlobalBlocking extension versions prior to 1.40.2 Description The issue is related to the GlobalBlocking extension in MediaWiki, where improper input neutralization during web page creation can lead to securi...

MediaWiki index.php 'uselang' Parameter XSS

The version of MediaWiki running on the remote host is affected by a cross-site scripting vulnerability due to a failure to properly sanitize user-supplied input to the 'uselang' parameter in the 'index.php' script. An attacker can exploit this to inject arbitrary HTML and script code into a user...

MediaWiki < 1.17.5, 1.18.x < 1.18.4, 1.19.x < 1.19.1 'uselang' Parameter XSS Vulnerability - Active Check

MediaWiki is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2012-2698

Cross-site scripting XSS vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Mainpage...

DEBIAN-CVE-2012-2698

Cross-site scripting XSS vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Mainpage...

Cross site scripting

Cross-site scripting XSS vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Mainpage...

CVE-2012-2698: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the outputPage function in includes/SkinTemplate.php in MediaWiki before 1.17.5, 1.18.x before 1.18.4, and 1.19.x before 1.19.1 allows remote attackers to inject arbitrary web script or HTML via the uselang parameter to index.php/Mainpage...