CVE-2025-21612

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-21612
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-21612.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-21612
Aliases
Published
2025-01-06T16:15:31Z
Modified
2025-01-14T19:01:33Z
Summary
[none]
Details

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.

References

Affected packages

Git / github.com/starcitizentools/mediawiki-extensions-tabberneue

Affected ranges

Type
GIT
Repo
https://github.com/starcitizentools/mediawiki-extensions-tabberneue
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d8c3db4e5935476e496d979fb01f775d3d3282e6
Fixed
f229cab099c69006e25d4bad3579954e481dc566