Description
An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams: Special:SportsManagerLogo and Special:SportsTeamsManagerLogo do not check for the sportsteamsmanager user right, and thus an attacker may be able to affect pages that are concerned with sports teams.
Remediation
References
Related Vulnerabilities
WordPress Plugin Wufoo Shortcode Cross-Site Scripting (1.47)
Varnish Cache Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-0345)
Joomla Other Vulnerability (CVE-2013-1453)
XWiki Improper Encoding or Escaping of Output Vulnerability (CVE-2020-13654)
WordPress Plugin Email posts to subscribers Multiple Vulnerabilities (2.0)