https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-05T02:13:42.236729+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-77608 fkie_cve-2026-77608 2026-10-05T02:13:43.370215+00:00

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.

 https://vulnerability.circl.lu/vuln/ghsa-59xw-qv23-j3rc GHSA-59xw-qv23-j3rc — Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters) 2026-10-05T02:13:43.370465+00:00

Affected: Packagist: mediawiki/semantic-media-wiki

#### Failure mode

The `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding.

#### Remediation

- The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into HTML.

#### Maintenance note

Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.