Most recent entries from all https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 05:54:29 +0000 fkie_cve-2026-77608 https://vulnerability.circl.lu/vuln/fkie_cve-2026-77608 <p>Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Prior to version 7.2.0, when the `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.</p> <p>Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki&#39;s pages. Prior to version 7.2.0, when the `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0 fixes the issue.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-77608 GHSA-59xw-qv23-j3rc — Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters) https://vulnerability.circl.lu/vuln/ghsa-59xw-qv23-j3rc <p><strong>Affected:</strong> Packagist: mediawiki/semantic-media-wiki</p> <p>#### Failure mode</p> <p>The `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding.</p> <p>#### Remediation</p> <p>- The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into HTML.</p> <p>#### Maintenance note</p> <p>Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.</p> <p><strong>Affected:</strong> Packagist: mediawiki/semantic-media-wiki</p> <p>#### Failure mode</p> <p>The `value` parameter was reflected back into rendered output and error messaging paths without enough output-context encoding.</p> <p>#### Remediation</p> <p>- The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into HTML.</p> <p>#### Maintenance note</p> <p>Do not treat error text as trusted just because it originated from validation. Validation output can still be attacker-influenced.</p> https://vulnerability.circl.lu/vuln/ghsa-59xw-qv23-j3rc