Description

Cross-site scripting (XSS) vulnerability in includes/Sanitizer.php in the variable handler in MediaWiki 1.6.x before r14349 allows remote attackers to inject arbitrary Javascript via unspecified vectors, possibly involving the usage of the | (pipe) character.

Remediation

References

CVE-2006-2611

Related Vulnerabilities

Liferay Portal Missing Authorization Vulnerability (CVE-2025-43773)

WordPress Plugin Photospace Responsive Gallery Unspecified Vulnerability (1.1.7)

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark SQL Injection (2.8.6)

PHP Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2017-7963)

Coppermine Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-7186)

Severity

Medium

Classification

CVE-2006-2611

Tags

Missing Update Known Vulnerabilities