Catrope

**Name of the Vulnerable Software and Affected Versions** Mediawiki - WikiLove Extension version 1.39 **Description** The Wikimedia Foundation Mediawiki - WikiLove Extension contains a flaw related to improper input handling during web page creation, potentially leading to Stored Cross-site Scripting (XSS). This issue allows for the injection of malicious scripts into web pages. The vulnerability exists due to insufficient sanitization of user-supplied data. **Recommendations** Update Mediawiki - WikiLove Extension to a newer version that addresses this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** MediaWiki versions prior to 1.23.12 MediaWiki versions 1.24.x prior to 1.24.5 MediaWiki versions 1.25.x prior to 1.25.4 MediaWiki versions 1.26.x prior to 1.26.1 **Description** The issue arises from improper sanitization of parameters when calling the cURL library. This allows remote attackers to read arbitrary files via an @ (at sign) character in unspecified POST array parameters. **Recommendations** For MediaWiki versions prior to 1.23.12, update to version 1.23.12 or later. For MediaWiki versions 1.24.x prior to 1.24.5, update to version 1.24.5 or later. For MediaWiki versions 1.25.x prior to 1.25.4, update to version 1.25.4 or later. For MediaWiki versions 1.26.x prior to 1.26.1, update to version 1.26.1 or later.