Description
Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI.
Remediation
References
Related Vulnerabilities
PHP Other Vulnerability (CVE-1999-0058)
PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-10545)
Drupal Other Vulnerability (CVE-2016-3166)
WordPress Plugin W3 Total Cache Information Disclosure (0.9.2.4)
WordPress Plugin WP Favorite Posts Cross-Site Scripting (1.6.5)