CVE-2026-116892mediumCWE-79

CVE-2026-116892: falha de média gravidade em SemanticMediaWiki

SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar SemanticMediaWiki

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.2%
SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject markup through the search parameter of the extended Special:Search profile. Attackers can send visitors crafted URLs using the smw profile with SVG event handlers, which ProfileForm::profile_sheet inserts unescaped into a pre element, executing script in the wiki origin.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
SemanticMediaWiki · SemanticMediaWiki
CVEs relacionadas — SemanticMediaWiki

No mesmo produto, das mais perigosas para as menos.

CVE-2026-116878HIGHSemantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via Special:PropertyLabelSimilarityEPSS 0.4%CVE-2025-61682HIGHSemantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributesEPSS 0.4%CVE-2026-116871HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Uncontrolled Recursion via Special:AskEPSS 0.4%CVE-2026-116877HIGHSemantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_eventEPSS 0.4%CVE-2026-116872HIGHSemantic MediaWiki 3.0.0 before 7.3.1 Denial of Service via Special:Search Compact FiltersEPSS 0.4%CVE-2026-77616MEDIUMSemantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination tokenEPSS 0.3%