CVE-2005-4501
MediaWiki < 1.5.4 - Cross-Site Scripting via Inline Style Attributes
Title source: llmDescription
MediaWiki before 1.5.4 uses a hard-coded "internal placeholder string", which allows remote attackers to bypass protection against cross-site scripting (XSS) attacks and execute Javascript using inline style attributes, which are processed by Internet Explorer.
References (7)
Core 7
Core References
Patch x_refsource_confirm
http://www.mediawiki.org/wiki/Download
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2005/3059
Patch, Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/18219
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/23882
Various Sources vendor-advisory
x_refsource_suse
http://lists.suse.com/archive/suse-security-announce/2006-Feb/0001.html
Patch vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/16032
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/18717
Scores
EPSS
0.0057
EPSS Percentile
68.9%
Details
Status
published
Products (45)
mediawiki/mediawiki
1.1.0
mediawiki/mediawiki
1.2.0
mediawiki/mediawiki
1.2.1
mediawiki/mediawiki
1.2.2
mediawiki/mediawiki
1.2.3
mediawiki/mediawiki
1.2.4
mediawiki/mediawiki
1.2.5
mediawiki/mediawiki
1.2.6
mediawiki/mediawiki
1.3
mediawiki/mediawiki
1.3.0
... and 35 more
Published
Dec 22, 2005
Tracked Since
Feb 18, 2026