Description
The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack.
Remediation
References
Related Vulnerabilities
PrestaShop Files or Directories Accessible to External Parties Vulnerability (CVE-2020-5250)
MySQL CVE-2015-0438 Vulnerability (CVE-2015-0438)
WordPress Plugin Smooth Slider SQL Injection (2.6.5)
WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery Cross-Site Scripting (1.5.22)
DOMPurify Incorrect Comparison Vulnerability (CVE-2026-65903)