| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki | = 1.1.0= 1.10.0= 1.10.1= 1.10.2= 1.10.3= 1.10.4= 1.11= 1.11.0= 1.11.1= 1.11.2= 1.12.0= 1.12.1= 1.12.2= 1.12.3= 1.12.4= 1.13.0= 1.13.1= 1.13.2= 1.13.3= 1.13.4= 1.14.0= 1.14.1= 1.15.0= 1.15.1= 1.15.2= 1.15.3= 1.15.4= 1.15.5= 1.16.0= 1.16.1= 1.16.2= 1.17= 1.17.0= 1.17.1= 1.17.2= 1.17.3= 1.17.4= 1.18= 1.18.0= 1.18.1= 1.18.2= 1.18.3= 1.19= 1.19.0= 1.19.1= 1.19.10= 1.19.2= 1.19.3= 1.19.4= 1.19.5= 1.19.6= 1.19.7= 1.19.8= 1.19.9= 1.20= 1.20.1= 1.20.2= 1.20.3= 1.20.4= 1.20.5= 1.20.6= 1.20.7= 1.20.8= 1.21= 1.21.1= 1.21.2= 1.21.3= 1.21.4= 1.21.5= 1.22.0= 1.22.1= 1.22.2≤ 1.19.11 |
Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free