Description
An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization (i18n).
Remediation
References
Related Vulnerabilities
WordPress Plugin WP-DBManager Multiple Vulnerabilities (2.71)
Moodle Improper Input Validation Vulnerability (CVE-2009-1171)
Apache Tomcat Incomplete Cleanup Vulnerability (CVE-2023-42794)
Jboss EAP Deserialization of Untrusted Data Vulnerability (CVE-2015-7501)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2009-4299)