Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.
References (3)
Core 3
Core References
Issue Tracking, Vendor Advisory
https://phabricator.wikimedia.org/T368628
Exploit, Issue Tracking, Vendor Advisory
https://phabricator.wikimedia.org/T370632
Scores
CVSS v3
9.8
EPSS
0.0051
EPSS Percentile
66.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-89
Status
published
Products (1)
mediawiki/cargo
3.6.0
Published
Oct 05, 2024
Tracked Since
Feb 18, 2026