Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

10 records

Vendor: mediawiki Component: Cargo Clear all filters
TI-2026-12144 CVE-2026-14363 · GHSA-cj99-hcr5-53g3

Cargo Extension: SQLi in Special:Drilldown

Priority HIGH 70

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00523 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-89
TI-2026-42112 CVE-2026-58521 · GHSA-9j5g-78q4-mjh2

SQLi in Cargo extension via year range filter

Priority HIGH 70

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00554 Published 2026-07-01 Fixed in 1.43.9,1.44.6,1.45.4 CWE-89
TI-2026-42110 CVE-2026-58519 · GHSA-r23x-87q7-xq2f

Stored XSS through Cargo's map format

Priority HIGH 70

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00241 Published 2026-07-01 Fixed in 3.9.1 CWE-79
TI-2026-28719 CVE-2026-39837 · GHSA-6m53-gpj2-w66j

Stored XSS through the dynamic table format in Cargo

Priority MEDIUM 61

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00196 Published 2026-04-07 Fixed in 3.8.7 CWE-80
TI-2026-28723 CVE-2026-39841 · GHSA-2mg7-w9r8-29mw

Stored XSS through list fields on Cargo's page values and Special:CargoTables

Priority MEDIUM 61

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8…

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00164 Published 2026-04-07 Fixed in 3.8.7 CWE-80
TI-2026-28722 CVE-2026-39840 · GHSA-8m8x-w498-p4wx

CSS injection in multiple Cargo display formats

Priority MEDIUM 56

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00164 Published 2026-04-07 Fixed in 3.8.7 CWE-79
TI-2026-28721 CVE-2026-39839 · GHSA-r77j-8275-g6jm

Stored XSS through URLs in Cargo's map format

Priority MEDIUM 61

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8…

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00188 Published 2026-04-07 Fixed in 3.8.7 CWE-80
TI-2024-32108 CVE-2024-47847 · GHSA-jqvm-9xm2-gc38

Various XSSes found in Cargo

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Car…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0041 Published 2024-10-05 Fixed in 3.6.1 CWE-79
TI-2024-32107 CVE-2024-47846 · GHSA-qfhq-ccm6-g4wq

Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Priority HIGH 70

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00288 Published 2024-10-05 Fixed in 3.6.1 CWE-352
TI-2024-32110 CVE-2024-47849 · GHSA-q7xp-xjgh-vpm7

Backticks can allow the usage of not-allowed SQL functions

Priority HIGH 77

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X befor…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00555 Published 2024-10-05 Fixed in 3.6.1 CWE-89