CVE-2013-4305

Mediawiki - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in contrib/example.php in the SyntaxHighlight GeSHi extension for MediaWiki, possibly as downloaded before September 2013, allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO.

References (5)

[Third Party Advisory, VDB Entry] http://osvdb.org/96909

[Various Sources] http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.html

[Patch] http://seclists.org/oss-sec/2013/q3/553

[Exploit, Patch] https://bugzilla.wikimedia.org/show_bug.cgi?id=49070

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/86890

Scores

EPSS 0.0019

EPSS Percentile 40.2%

Details

CWE

CWE-79

Status published

Products (4)

mediawiki/mediawiki

n/a/n/a

Published Oct 11, 2013

Tracked Since Feb 18, 2026