Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: The Wikimedia Foundation Mediawiki - Cargo 3.6.1 Clear all filters
TI-2024-32108 CVE-2024-47847 · GHSA-jqvm-9xm2-gc38

Various XSSes found in Cargo

Priority HIGH 70

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Car…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0041 Published 2024-10-05 Fixed in 3.6.1 CWE-79
TI-2024-32107 CVE-2024-47846 · GHSA-qfhq-ccm6-g4wq

Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Priority HIGH 70

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00288 Published 2024-10-05 Fixed in 3.6.1 CWE-352
TI-2024-32110 CVE-2024-47849 · GHSA-q7xp-xjgh-vpm7

Backticks can allow the usage of not-allowed SQL functions

Priority HIGH 77

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X befor…

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00555 Published 2024-10-05 Fixed in 3.6.1 CWE-89