Mediawiki Cargo vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Mediawiki Cargo: 7 record(s), with affected versions and fixes.cpe:2.3:a:mediawiki:cargo
CVE-2026-14363
Critical · 9.8
CWE-89 Jul 1, 2026
Cargo Extension: SQLi in Special:Drilldown
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.
This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
CVE-2026-58521
Critical · 9.8
CWE-89 Jul 1, 2026
SQLi in Cargo extension via year range filter
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.
This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
CVE-2026-58519
Medium · 5.4
CWE-79 Jul 1, 2026
Stored XSS through Cargo's map format
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.
This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.
CVE-2026-39841
Medium · 6.1
CWE-79 Apr 7, 2026
Stored XSS through list fields on Cargo's page values and Special:CargoTables
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
CVE-2026-39840
Medium · 6.1
CWE-79 Apr 7, 2026
CSS injection in multiple Cargo display formats
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows XSS Targeting Non-Script Elements.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
CVE-2026-39839
Medium · 6.1
CWE-80 Apr 7, 2026
Stored XSS through URLs in Cargo's map format
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.
CVE-2026-39837
Medium · 5.4
CWE-80 Apr 7, 2026
Stored XSS through the dynamic table format in Cargo
Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in WikiWorks Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.