CVE-2014-9479

MediaWiki - Cross-Site Scripting via TemplateSandbox Text Parameter

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text parameter to Special:TemplateSandbox.

References (4)

Core 4
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/01/03/13
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/12/21/2
Exploit x_refsource_confirm
https://phabricator.wikimedia.org/T76195

Scores

EPSS 0.0026
EPSS Percentile 49.3%

Details

CWE
CWE-79
Status published
Products (46)
mediawiki/mediawiki 1.20
mediawiki/mediawiki 1.20.1
mediawiki/mediawiki 1.20.2
mediawiki/mediawiki 1.20.3
mediawiki/mediawiki 1.20.4
mediawiki/mediawiki 1.20.5
mediawiki/mediawiki 1.20.6
mediawiki/mediawiki 1.20.7
mediawiki/mediawiki 1.20.8
mediawiki/mediawiki 1.21
... and 36 more
Published Jan 16, 2015
Tracked Since Feb 18, 2026