CVE-2025-43861: fallo de gravedad media en miraheze ManageWiki
ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 4.4epss 0.3%
ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to reflected or stored XSS in the review dialog. A logged-in attacker must change a form field to include a malicious payload. If that same user then opens the "Review Changes" dialog, the payload will be rendered and executed in the context of their own session. This issue has been patched in commit 2f177dc.
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
miraheze · ManageWikiCVEs relacionadas — miraheze ManageWiki
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-29483CRITICALwikiconfig API leaked private config variables set through ManageWikiEPSS 1.2%CVE-2025-32956HIGHManageWiki has SQL injection vulnerability in NamespaceMigrationJobEPSS 0.7%CVE-2024-25109MEDIUMCross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWikiEPSS 0.4%CVE-2025-32964MEDIUMManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensionsEPSS 0.2%