Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-23038 State: PUBLISHED Published: 2025-01-13T23:35:19.029Z Last Updated: 2025-01-14T15:35:03.829Z Vendors: LabRedesCefetRJ Products: WeGIA Problem Types: CWE-79 Description: WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting (XSS) vulnerability was identified in the `remuneracao.php` endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts into the `descricao` parameter. The injected scripts are stored on the server and executed automatically whenever the affected page is accessed by users, posing a significant security risk. The application fails to
matically whenever the affected page is accessed by users, posing a significant security risk. The application fails to properly validate and sanitize user inputs in the `remuneracao.php` parameter. This lack of validation allows attackers to inject malicious scripts, which are then stored on the server. Whenever the affected page is accessed, the malicious payload is executed in the victim's browser, potentially compromising the user's data and system. This issue has been addressed in version 3.2.6. All users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA
vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/LabRedesCefetRJ/WeGIA/security/advisories/GHSA-rp2v-7hpw-m6qc - https://github.com/LabRedesCefetRJ/WeGIA/commit/0d81074c6fc0470373ecc85738f47b83357a0a7e
CVE ID: CVE-2025-23039 State: PUBLISHED Published: 2025-01-17T20:13:13.156Z Last Updated: 2025-01-17T20:35:26.480Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: caido Products: caido Problem Types: CWE-79 Description: Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to the theft of sensitive information. This issue has been addressed in version 0.45.1 and all users are advised to upgrade. There are no known worka
ormation. This issue has been addressed in version 0.45.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/caido/caido/security/advisories/GHSA-3mfw-fhfp-mgrv
CVE ID: CVE-2025-23040 State: PUBLISHED Published: 2025-01-15T17:25:00.945Z Last Updated: 2025-01-15T20:16:39.997Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: desktop Products: desktop Problem Types: CWE-522 Description: GitHub Desktop is an open-source Electron-based GitHub app designed for git development. An attacker convincing a user to clone a repository directly or through a submodule can allow the attacker access to the user's credentials through the use of maliciously crafted remote URL. GitHub Desktop relies on Git to perform all network related operations (such as cloning, fetching, and pushing). When a user attempts to clone a repository GitHu
ll network related operations (such as cloning, fetching, and pushing). When a user attempts to clone a repository GitHub Desktop will invoke `git clone` and when Git encounters a remote which requires authentication it will request the credentials for that remote host from GitHub Desktop using the git-credential protocol. Using a maliciously crafted URL it's possible to cause the credential request coming from Git to be misinterpreted by Github Desktop such that it will send credentials for a different host than the host that Git is currently communicating with thereby allowing for secret exfiltration. GitHub username and OAuth token, or credentials for other Git remote hosts stored in GitH
owing for secret exfiltration. GitHub username and OAuth token, or credentials for other Git remote hosts stored in GitHub Desktop could be improperly transmitted to an unrelated host. Users should update to GitHub Desktop 3.4.12 or greater which fixes this vulnerability. Users who suspect they may be affected should revoke any relevant credentials. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/desktop/desktop/security/advisories/GHSA-36mm-rh9q-cpqq - https://docs.github.com/en/apps/using-github-apps/reviewing-and-revoking-authorization-of-github-apps - https://git-scm.com/docs/git-credential
CVE ID: CVE-2025-23041 State: PUBLISHED Published: 2025-01-14T18:54:45.430Z Last Updated: 2025-01-14T20:44:40.909Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L) Vendors: umbraco Products: Umbraco.Forms.Issues Problem Types: CWE-20 Description: Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated only client-side, not server-side. This issue has been patched in versions 8.13.16, 10.5.7, 13.2.2, and 14.1.2. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com
no known workarounds for this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/umbraco/Umbraco.Forms.Issues/security/advisories/GHSA-9v8m-qv22-f268
CVE ID: CVE-2025-23042 State: PUBLISHED Published: 2025-01-14T18:49:16.329Z Last Updated: 2025-02-12T20:31:19.766Z Vendors: gradio-app Products: gradio Problem Types: CWE-285 Description: Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python function. Gradio's Access Control List (ACL) for file paths can be bypassed by altering the letter case of a blocked file or directory path. This vulnerability arises due to the lack of case normalization in the file path validation logic. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent s
. On case-insensitive file systems, such as those used by Windows and macOS, this flaw enables attackers to circumvent security restrictions and access sensitive files that should be protected. This issue can lead to unauthorized data access, exposing sensitive information and undermining the integrity of Gradio's security model. Given Gradio's popularity for building web applications, particularly in machine learning and AI, this vulnerability may pose a substantial threat if exploited in production environments. This issue has been addressed in release version 5.6.0. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vu
s are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/gradio-app/gradio/security/advisories/GHSA-j2jg-fq62-7c3h
CVE ID: CVE-2025-23044 State: PUBLISHED Published: 2025-01-20T15:43:23.882Z Last Updated: 2025-02-12T20:41:20.188Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: pwndoc Products: pwndoc Problem Types: CWE-352 Description: PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This includes GET and POST requests due to the missing SameSite= attribute on cookies and the ability to refresh cookies. Commit 14acb704891245bf1703ce6296d62112e85aa995 patches the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pwndoc/pwndoc/secu
atches the issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/pwndoc/pwndoc/security/advisories/GHSA-9v2v-jxvw-52rq - https://github.com/pwndoc/pwndoc/commit/14acb704891245bf1703ce6296d62112e85aa995
CVE ID: CVE-2025-23045 State: PUBLISHED Published: 2025-01-28T15:19:26.196Z Last Updated: 2025-01-28T16:16:54.414Z Vendors: cvat-ai Products: cvat Problem Types: CWE-502 Description: Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. An attacker with an account on an affected CVAT instance is able to run arbitrary code in the context of the Nuclio function container. This vulnerability affects CVAT deployments that run any of the serverless functions of type tracker from the CVAT Git repository, namely TransT and SiamMask. Deployments with custom functions of type tracker may also be affected, depending on how they handle state seria
amMask. Deployments with custom functions of type tracker may also be affected, depending on how they handle state serialization. If a function uses an unsafe serialization library such as pickle or jsonpickle, it's likely to be vulnerable. Upgrade to CVAT 2.26.0 or later. If you are unable to upgrade, shut down any instances of the TransT or SiamMask functions you're running. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cvat-ai/cvat/security/advisories/GHSA-wq36-mxf8-hv62 - https://github.com/cvat-ai/cvat/commit/563e1dfde64b15fa042b23f9d09cd854b35f0366
CVE ID: CVE-2025-23046 State: PUBLISHED Published: 2025-02-25T17:48:17.801Z Last Updated: 2025-02-25T19:30:57.599Z Vendors: glpi-project Products: glpi Problem Types: CWE-303 Description: GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth authorization has already been established. Version 10.0.18 contains a patch. As a workaround, one may disable any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP
e may disable any "Mail servers" authentication provider configured to use an Oauth connection provided by the OauthIMAP plugin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/glpi-project/glpi/security/advisories/GHSA-vfxc-qg3v-j2r5 - https://github.com/glpi-project/glpi/releases/tag/10.0.18
CVE ID: CVE-2025-23047 State: PUBLISHED Published: 2025-01-22T17:20:09.715Z Last Updated: 2025-02-12T20:41:24.045Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: cilium Products: cilium Problem Types: CWE-200 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could le
ther Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d. Additiona
ORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cilium/cilium/security/advisories/GHSA-h78m-j95m-5356 - https://github.com/cilium/cilium/commit/a3489f190ba6e87b5336ee685fb6c80b1270d06d
CVE ID: CVE-2025-23048 State: PUBLISHED Published: 2025-07-10T16:56:53.545Z Last Updated: 2025-11-04T21:09:37.109Z Vendors: Apache Software Foundation Products: Apache HTTP Server Problem Types: CWE-284 Description: In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtu
icateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://httpd.apache.org/security/vulnerabilities_24.html
CVE ID: CVE-2025-23049 State: PUBLISHED Published: 2025-06-23T00:00:00.000Z Last Updated: 2025-10-23T14:11:08.899Z Vendors: Materialise Products: OrthoView Problem Types: CWE-78 Description: Meridian Technique Materialise OrthoView through 7.5.1 allows OS Command Injection when servlet sharing is enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.materialise.com/en/healthcare/orthoview - https://www.materialise.com/en/healthcare/orthoview/security-vulnerability - https://outurnate.com/remote-code-execution-and-authentication-bypass-in-materialise-orthoview-cve-2025-23049
CVE ID: CVE-2025-23050 State: PUBLISHED Published: 2025-10-31T00:00:00.000Z Last Updated: 2025-10-31T16:47:22.226Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Qt Products: Qt Problem Types: CWE-125 Description: QLowEnergyController in Qt before 6.8.2 mishandles malformed Bluetooth ATT commands, leading to an out-of-bounds read (or division by zero). This is fixed in 5.15.19, 6.5.9, and 6.8.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://codereview.qt-project.org/q/QLowEnergyController - https://www.qt.io/blog/security-advisory-qlowenergycontroller-on-linux
CVE ID: CVE-2025-23051 State: PUBLISHED Published: 2025-01-14T17:35:25.108Z Last Updated: 2025-01-23T21:18:23.255Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking AOS Description: An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitation could allow an authenticated user to leverage parameter injection to overwrite arbitrary system files. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04723en_us&docLocale=en_US
CVE ID: CVE-2025-23052 State: PUBLISHED Published: 2025-01-14T17:38:43.844Z Last Updated: 2025-01-23T21:14:36.522Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking AOS Description: Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04723en_us&docLocale=en_US
CVE ID: CVE-2025-23053 State: PUBLISHED Published: 2025-01-28T17:21:45.987Z Last Updated: 2025-03-13T18:13:52.965Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Fabric Composer (AFC) Description: A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us
st Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US
CVE ID: CVE-2025-23054 State: PUBLISHED Published: 2025-01-28T17:17:17.694Z Last Updated: 2025-03-13T14:27:35.564Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Fabric Composer (AFC) Description: A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perform operations not allowed by their privilege level. Successful exploitation could allow an attacker to manipulate user generated files, potentially leading to unauthorized changes in critical system configurations. Additional Analyst Notes: - CI
ted files, potentially leading to unauthorized changes in critical system configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US
CVE ID: CVE-2025-23055 State: PUBLISHED Published: 2025-01-28T17:11:38.749Z Last Updated: 2025-03-13T13:39:21.174Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Fabric Composer (AFC) Description: A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
ser within the context of the compromised interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04775en_us&docLocale=en_US
CVE ID: CVE-2025-23056 State: PUBLISHED Published: 2025-01-28T17:11:58.146Z Last Updated: 2025-03-13T14:47:58.938Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Fabric Composer (AFC) Description: A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
CVE ID: CVE-2025-23057 State: PUBLISHED Published: 2025-01-28T17:12:23.359Z Last Updated: 2025-03-13T14:39:29.316Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking Fabric Composer (AFC) Description: A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-site scripting (XSS) attack. If successfully exploited, a threat actor could run arbitrary script code in a victim's web browser within the context of the compromised interface. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
CVE ID: CVE-2025-23058 State: PUBLISHED Published: 2025-02-04T18:07:56.711Z Last Updated: 2025-03-13T13:28:04.186Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking ClearPass Policy Manager Description: A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauthorized access to data and the ability to execute functions that should be restricted to administrators only with read/write privileges. Successful exploitation could enable a low-privileged user to execute administrative functions leading to an
privileges. Successful exploitation could enable a low-privileged user to execute administrative functions leading to an escalation of privileges. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US
CVE ID: CVE-2025-23059 State: PUBLISHED Published: 2025-02-04T18:10:21.793Z Last Updated: 2025-03-13T15:25:04.877Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking ClearPass Policy Manager Description: A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If exploited successfully, this vulnerability allows an authenticated remote attacker with high privileges to access and retrieve sensitive data, potentially compromising the integrity and security of the entire system. Additional Analyst Notes
rieve sensitive data, potentially compromising the integrity and security of the entire system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US
CVE ID: CVE-2025-23060 State: PUBLISHED Published: 2025-02-04T18:11:41.371Z Last Updated: 2025-03-13T14:09:34.595Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hewlett Packard Enterprise (HPE) Products: HPE Aruba Networking ClearPass Policy Manager Description: A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vulnerability could allow an attacker to perform a man-in-the-middle attack, potentially granting unauthorized access to network resources as well as enabling data tampering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http
work resources as well as enabling data tampering. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbnw04784en_us&docLocale=en_US
CVE ID: CVE-2025-23061 State: PUBLISHED Published: 2025-01-15T00:00:00 Last Updated: 2025-01-15T15:11:21.314Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: mongoosejs Products: Mongoose Problem Types: CWE-94 Description: Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an incomplete fix for CVE-2024-53900. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.npmjs.com/package/mongoose?activeTab=versions - https://github.com/Automattic/mongoose/blob/master/CHANGELOG.md - https://github.com/Automattic/mongoose/releases/tag/8.9.5 - h
/github.com/Automattic/mongoose/blob/master/CHANGELOG.md - https://github.com/Automattic/mongoose/releases/tag/8.9.5 - https://github.com/Automattic/mongoose/commit/64a9f9706f2428c49e0cfb8e223065acc645f7bc
CVE ID: CVE-2025-23072 State: PUBLISHED Published: 2025-01-14T18:29:20.768Z Last Updated: 2025-03-13T18:20:27.524Z Vendors: Wikimedia Foundation Products: Mediawiki - RefreshSpecial Extension Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RefreshSpecial Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - RefreshSpecial Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phabricator.wikimedia.org/T378885 - https://gerrit.wikimedia