Description
Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI.
Remediation
References
Related Vulnerabilities
MySQL CVE-2018-2787 Vulnerability (CVE-2018-2787)
Jenkins Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-3724)
e107 Other Vulnerability (CVE-2006-5786)
WordPress Plugin WP Job Manager Privilege Escalation (1.34.3)
WordPress Plugin 5gig Concerts Unspecified Vulnerability (1.0)