Advisories · Technology
The Wikimedia Foundation Mediawiki - Cargo extension.
Every CVE that names The Wikimedia Foundation Mediawiki - Cargo extension among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.1 Medium
XSS in Cargo's Special:CargoQuery page due to unsanitized table headers
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Cargo Exhibit field alias allows stored XSS
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Reflected XSS through Cargo Drilldown full-text search
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Anonymous reflected XSS in CargoExport invalid-alias errors
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Reflected XSS in Cargo Drilldown hierarchy filters
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 2.3 Low
Stored XSS in Cargo Drilldown tab names
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Cargo Extension: SQLi in Special:Drilldown
- The Wikimedia Foundation Mediawiki - Cargo Extension
- SQL injection
- CVSS 6.9 Medium
SQLi in Cargo extension via year range filter
- The Wikimedia Foundation Mediawiki - Cargo Extension
- SQL injection
- CVSS 6.9 Medium
Stored XSS through Cargo's map format
- The Wikimedia Foundation Mediawiki - Cargo Extension
- Cross-site scripting (XSS)
- CVSS 2.1 Low
SQL injection in Cargo via Special:CargoExport
- The Wikimedia Foundation MediaWiki Cargo extension
- SQL injection