Description
An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization (i18n).
Remediation
References
Related Vulnerabilities
WordPress Plugin BuddyPress Information Disclosure (5.1.1)
MySQL CVE-2014-6507 Vulnerability (CVE-2014-6507)
Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-4790)
WordPress Plugin Simple Retail Menus SQL Injection (4.0.1)
WordPress Plugin WP-Cron Dashboard Cross-Site Scripting (1.1.5)