CVE-2025-21612
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2025-21612
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21612.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2025-21612
- Aliases
- Published
- 2025-01-06T15:47:27Z
- Modified
- 2025-11-13T19:50:09.877669Z
- Severity
-
- 8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CVSS Calculator
- Summary
- Cross-site Scripting in TabberTransclude in Extension:TabberNeue
- Details
-
TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.
- Database specific
{ "cwe_ids": [ "CWE-79", "CWE-80" ] }- References
-
- https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/d8c3db4e5935476e496d979fb01f775d3d3282e6
- https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/commit/f229cab099c69006e25d4bad3579954e481dc566
- https://github.com/StarCitizenTools/mediawiki-extensions-TabberNeue/security/advisories/GHSA-4x6x-8rm8-c37j