CVE-2025-43861

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2025-43861

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-43861.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2025-43861

Aliases

GHSA-859x-46h8-vcrv

Published

2025-04-24T20:49:57Z

Modified

2025-10-14T14:33:32Z

Severity

4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection

Details

ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to reflected or stored XSS in the review dialog. A logged-in attacker must change a form field to include a malicious payload. If that same user then opens the "Review Changes" dialog, the payload will be rendered and executed in the context of their own session. This issue has been patched in commit 2f177dc.

References

Affected packages

Git /

Affected ranges

Database specific

{
    "unresolved_versions": [
        {
            "type": "",
            "events": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "2f177dc"
                }
            ]
        }
    ]
}