Description

Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page.

Remediation

References

CVE-2014-9478

Related Vulnerabilities

WordPress Plugin Essential Blocks-Page Builder Gutenberg Blocks, Patterns & Templates Multiple Security Bypass Vulnerabilities (4.0.6)

Wordpress Plugin Backup Migration Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2023-6972)

WordPress Plugin XML Sitemap & Google News feeds Cross-Site Scripting (3.9)

Jenkins Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-3663)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2007-2510)

Severity

Low

Classification

CVE-2014-9478 CWE-707

Tags

Missing Update Known Vulnerabilities