CVE-2026-126567mediumCWE-79

CVE-2026-126567: fallo de gravedad media en SemanticMediaWiki

Semantic MediaWiki 3.0.0 before 7.4.1 Stored XSS via Special:Ask Debug Output

Publicada el

Seguir esta CVE+ Monitorear SemanticMediaWiki

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

10Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.1
Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the ElasticStore backend, allowing users with edit rights to inject script through unescaped native_result and score_set output. Attackers can store markup in a Text property or subobject name, then lure victims including administrators to a crafted Special:Ask link to execute script in their session.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Productos afectados
SemanticMediaWiki · SemanticMediaWiki
CVEs relacionadas — SemanticMediaWiki

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-116878HIGHSemantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarityEPSS 0.4%CVE-2025-61682HIGHSemantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributesEPSS 0.4%CVE-2026-116871HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:AskEPSS 0.4%CVE-2026-116877HIGHSemantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_eventEPSS 0.4%CVE-2026-116872HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact FiltersEPSS 0.4%CVE-2026-77616MEDIUMSemantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination tokenEPSS 0.3%