CVE-2026-116880: falha de alta gravidade em SemanticMediaWiki
Semantic MediaWiki 3.0.0 before 7.3.1 CSRF via Special:SMWAdmin Maintenance Actions
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.1epss 0.1%
Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup, entity-disposal, or job actions, causing semantic data loss and resource exhaustion.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
Produtos afetados
SemanticMediaWiki · SemanticMediaWikiCVEs relacionadas — SemanticMediaWiki
No mesmo produto, das mais perigosas para as menos.
CVE-2026-116878HIGHSemantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarityEPSS 0.4%CVE-2025-61682HIGHSemantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributesEPSS 0.4%CVE-2026-116871HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:AskEPSS 0.4%CVE-2026-116877HIGHSemantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_eventEPSS 0.4%CVE-2026-116872HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact FiltersEPSS 0.4%CVE-2026-77616MEDIUMSemantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination tokenEPSS 0.3%