PT-2026-126349
CVE-2026-116888
·
Published
2026-10-27
·
Updated
2026-10-27
Description by
CVSS 3.1
4.8
MediumMetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with the smw-schemaedit right to inject markup through an unescaped property group schema canonical name. Attackers can save a schema whose canonical name holds script markup, which GroupFormatter renders unescaped in Special:Browse headings, executing JavaScript in viewers' sessions including administrators.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾