-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from missing output encoding when handling the 'sort key' parameter. The GitHub patch clearly shows the addition of htmlspecialchars() to sanitize $sortKey in InfoAction.php. The unpatched code directly injected $sortKey (from user-controllable DEFAULTSORT) into the page info table without escaping, creating an XSS vector. The function responsible for building this output (pageInfo()) is the clear vulnerability point.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mediawiki/core | composer | < 1.21.9 | 1.21.9 |
| mediawiki/core | composer | >= 1.22.0, < 1.22.6 | 1.22.6 |
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report