CVE-2026-116883mediumCWE-79

CVE-2026-116883: falha de média gravidade em SemanticMediaWiki

Semantic MediaWiki 3.1.0 before 7.3.1 Stored XSS via Schema Descriptions

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SemanticMediaWiki

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.8epss 0.2%
Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement() in HtmlBuilder, altering pages and targeting users who view the schema.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
SemanticMediaWiki · SemanticMediaWiki
CVEs relacionadas — SemanticMediaWiki

No mesmo produto, das mais perigosas para as menos.

CVE-2026-116878HIGHSemantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarityEPSS 0.4%CVE-2025-61682HIGHSemantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributesEPSS 0.4%CVE-2026-116871HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:AskEPSS 0.4%CVE-2026-116877HIGHSemantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_eventEPSS 0.4%CVE-2026-116872HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact FiltersEPSS 0.4%CVE-2026-77616MEDIUMSemantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination tokenEPSS 0.3%