Priority MEDIUM 45
in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by…
Scratch-wiki
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
Scratch-wiki records in CISA KEVNo Scratch-wiki vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records
TI-2020-11951 CVE-2020-15179
HTML Injection in ScratchSig
Priority MEDIUM 41
The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting.
TI-2021-21135 CVE-2021-46252 · GHSA-xjc2-47vq-w6wg
A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki…
Priority LOW 29
A Cross-Site Request Forgery (CSRF) in RequirementsBypassPage.php of Scratch Wiki scratch-confirmaccount-v3 allows attackers to modify account request requirement bypasses.
TI-2022-20963 CVE-2022-42985 · GHSA-rmx9-w5vx-r35r
The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure…
Priority LOW 22
The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).