Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: Wikimedia Foundation Mediawiki - Cargo Extension 3.8.7 Clear all filters
TI-2026-28719 CVE-2026-39837 · GHSA-6m53-gpj2-w66j

Stored XSS through the dynamic table format in Cargo

Priority MEDIUM 61

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00196 Published 2026-04-07 Fixed in 3.8.7 CWE-80
TI-2026-28723 CVE-2026-39841 · GHSA-2mg7-w9r8-29mw

Stored XSS through list fields on Cargo's page values and Special:CargoTables

Priority MEDIUM 61

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8…

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00164 Published 2026-04-07 Fixed in 3.8.7 CWE-80
TI-2026-28722 CVE-2026-39840 · GHSA-8m8x-w498-p4wx

CSS injection in multiple Cargo display formats

Priority MEDIUM 56

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki…

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00164 Published 2026-04-07 Fixed in 3.8.7 CWE-79
TI-2026-28721 CVE-2026-39839 · GHSA-r77j-8275-g6jm

Stored XSS through URLs in Cargo's map format

Priority MEDIUM 61

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8…

CVSS 4.0MEDIUM 6.3 Network Low privileges User interaction EPSS 0.00188 Published 2026-04-07 Fixed in 3.8.7 CWE-80