Most severe vulnerabilities for "mediawiki cargo"

Where

Sort:

Versions

3.6.0

MediaWiki CargoBackticks can allow the usage of not-allowed SQL functions

Risk 86

Severity

9.8

SQL Injection

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

First published (updated )

CVE-2024-47849

MediaWiki CargoSpecial:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

Risk 77

Severity

8.8

CSRF

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

First published (updated )

CVE-2024-47846

MediaWiki CargoInput Validation

Risk 64

Severity

8.6

Input Validation

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. There is mishandling of backticks to smartSplit.

First published (updated )

CVE-2023-29134

composer/mediawiki/cargoVarious XSSes found in Cargo

Risk 43

Severity

6.9

XSS

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

First published (updated )

CVE-2024-47847

Wikimedia Foundation Mediawiki - Cargo ExtensionStored XSS through URLs in Cargo's map format

Risk 55

Severity

6.3

XSS

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

First published (updated )

CVE-2026-39839

Wikiworks MediaWiki - Cargo ExtensionStored XSS through the dynamic table format in Cargo

Risk 55

Severity

6.3

XSS

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

First published (updated )

CVE-2026-39837

Wikimedia Foundation Mediawiki - Cargo ExtensionStored XSS through list fields on Cargo's page values and Special:CargoTables

Risk 55

Severity

6.3

XSS

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

First published (updated )

CVE-2026-39841

Wikimedia Foundation MediaWiki Cargo extensionCSS injection in multiple Cargo display formats

Risk 38

Severity

5.1

XSS

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

First published (updated )

CVE-2026-39840

Trending

Versions

MediaWiki CargoBackticks can allow the usage of not-allowed SQL functions

MediaWiki CargoSpecial:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection

MediaWiki CargoInput Validation

composer/mediawiki/cargoVarious XSSes found in Cargo

Wikimedia Foundation Mediawiki - Cargo ExtensionStored XSS through URLs in Cargo's map format

Wikiworks MediaWiki - Cargo ExtensionStored XSS through the dynamic table format in Cargo

Wikimedia Foundation Mediawiki - Cargo ExtensionStored XSS through list fields on Cargo's page values and Special:CargoTables

Wikimedia Foundation MediaWiki Cargo extensionCSS injection in multiple Cargo display formats

Company

Resources

Contact