CVE-2025-53370: fallo de gravedad alta en StarCitizenTools mediawiki-skins-Citizen
Citizen stored XSS vulnerability through short descriptions
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.6epss 0.4%
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Productos afectados
StarCitizenTools · mediawiki-skins-CitizenCVEs relacionadas — StarCitizenTools mediawiki-skins-Citizen
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-36123MEDIUMCitizen has a Stored Cross-Site Scripting Vulnerability by editing MediaWiki:TaglineEPSS 0.5%CVE-2024-47536MEDIUMstarcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" fieldEPSS 0.5%CVE-2025-62508MEDIUMCitizen vulnerable to stored XSS in sticky header button messagesEPSS 0.4%CVE-2025-49578MEDIUMCitizen allows stored XSS in user registration date messageEPSS 0.4%CVE-2025-49576MEDIUMCitizen allows stored XSS in search no result messagesEPSS 0.4%CVE-2025-49575MEDIUMCitizen allows stored XSS in Command Palette tip messagesEPSS 0.4%