| Package | Affected versions | Patched versions |
|---|---|---|
| wikidata query gui | = 0.3.6≤ 0.3.5 |
ui/ResultView.js in Wikibase Wikidata Query Service GUI before 0.3.6-SNAPSHOT 2019-11-07 allows HTML injection when reporting the number of results and number of milliseconds. NOTE: this GUI code is no longer bundled with the Wikibase Wikidata Query Service snapshots, such as 0.3.6-SNAPSHOT.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free