Description
MediaWiki before 1.19.6 and 1.20.x before 1.20.5 allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated by a CDATA section containing valid UTF-7 encoded sequences in a SVG file, which is then incorrectly interpreted as UTF-8 by Chrome and Firefox.
Remediation
References
Related Vulnerabilities
ownCloud Uncontrolled Resource Consumption Vulnerability (CVE-2017-5867)
Joomla Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-18650)
WordPress Plugin Shopping Cart & eCommerce Store Multiple Security Bypass Vulnerabilities (3.0.20)
MySQL CVE-2022-21368 Vulnerability (CVE-2022-21368)
Django Inefficient Regular Expression Complexity Vulnerability (CVE-2023-36053)