Description
An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization (i18n).
Remediation
References
Related Vulnerabilities
Oracle JRE CVE-2012-0498 Vulnerability (CVE-2012-0498)
WordPress Plugin WP Session Manager SQL Injection (1.2.1)
WordPress Plugin MasterStudy LMS-for Online Courses and Education Security Bypass (3.2.13)
WordPress Plugin PowerPack Lite for Beaver Builder Cross-Site Scripting (1.3.0.4)
Jboss EAP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-6311)