CVE-2025-53480mediumCWE-79

CVE-2025-53480: falha de média gravidade em Wikimedia Foundation Mediawiki - CheckUser…

CheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate (Account information tab) via unsanitized i18n messages

Publicada em

Seguir esta CVE+ Monitorar Mediawiki - CheckUser extension

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.4epss 0.2%
The CheckUser extension’s Special:Investigate page has a vulnerability in the Account information tab, where specific internationalized messages are rendered without proper escaping. Attackers can exploit this by appending ?uselang=x-xss to the URL, causing reflected XSS when the UI renders affected message keys. This issue affects Mediawiki - CheckUser extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Wikimedia Foundation · Mediawiki - CheckUser extension
CVEs relacionadas — Wikimedia Foundation Mediawiki - CheckUser…

No mesmo produto, das mais perigosas para as menos.

CVE-2025-53479MEDIUMCheckUser: Reflected Cross-Site Scripting (XSS) in Special:CheckUser via unsanitized internationalized messageEPSS 0.2%CVE-2025-53478MEDIUMCheckUser: Reflected Cross-Site Scripting (XSS) in Special:Investigate via unsanitized i18n messagesEPSS 0.2%