PT-2026-102932
CVE-2026-103044
·
تاريخ النشر
2026-09-29
·
تاريخ التحديث
2026-10-01
الوصف من
CVSS 3.1
9.8
حرجةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Mediawiki - EasyTimeline extension versions prior to 1.46.1
Mediawiki - EasyTimeline extension version 1.45.5
Mediawiki - EasyTimeline extension version 1.43.10
Description
An XML injection issue, also known as blind XPath injection, exists in the Mediawiki - EasyTimeline extension. This allows an attacker to inject XML, which can be used to manipulate XPath queries to extract information from the XML document structure without the application returning the results directly in the response.
Recommendations
Update Mediawiki - EasyTimeline extension to a version newer than 1.46.1.
Update Mediawiki - EasyTimeline extension to a version newer than 1.45.5.
Update Mediawiki - EasyTimeline extension to a version newer than 1.43.10.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾