GHSA-375v-wx2r-4598: SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile

Published Oct 27, 2026

Updated

SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event handlers, which ProfileForm::profilesheet inserts unescaped into a pre element, executing script in the wiki origin.

Event History

Oct 27, 2026

CVE Published

via OSV·10:23 AM

Data Sourced

via OSV·10:23 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to exploitation?

Visitors who open an attacker-crafted URL targeting the extended Special:Search smw profile are exposed. The attacker does not need to authenticate to create and send the malicious URL.

What user interaction is required?

A victim must be persuaded to visit a crafted URL that uses the smw search profile. The malicious markup is then reflected into the page and can execute in the wiki's origin.

What is the likely security impact if exploitation succeeds?

The vulnerability permits script execution in the wiki origin. The supplied severity vector indicates low impacts to confidentiality and integrity for both the vulnerable component and a subsequent component, with no availability impact.

GHSA-375v-wx2r-4598: SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile

Event History

Frequently Asked Questions

Who is exposed to exploitation?

What user interaction is required?

What is the likely security impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to exploitation?

What user interaction is required?

What is the likely security impact if exploitation succeeds?