Description
MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.
Remediation
References
Related Vulnerabilities
MySQL Resource Management Errors Vulnerability (CVE-2012-2749)
PrestaShop Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2022-21686)
WordPress Plugin PayPal Digital Downloads Cross-Site Request Forgery (1.4)
WordPress Plugin WP eCommerce 'cs1' Parameter SQL Injection (3.8.6)
WordPress Plugin YITH WooCommerce Recover Abandoned Cart Security Bypass (1.3.2)