VDB

GCVE-110-MAGEIA-2014-253

GCVE-110-MAGEIA-2014-253
Advisory Published
Vulnetix · Advisory published June 6, 2014
XSS vulnerability in MediaWiki before 1.22.7, due to usernames on Special:PasswordReset being parsed as wikitext. The username on Special:PasswordReset can be supplied by anyone and will be parsed with wgRawHtml enabled. Since Special:PasswordReset is whitelisted by default on private wikis, this could potentially lead to an XSS crossing a privilege boundary (CVE-2014-3966).
Download JSON Open in Console

Affected Products

VendorProductVersionsPlatforms
Mageiamediawiki0 (affected), 1.22.7-1.mga4 (unaffected)—
Mageiamediawiki1.22.7-1.mga3 (unaffected), 0 (affected)—

Aliases

CVE-2014-3966

References

Updated mediawiki packages fix security vulnerability
advisory
Updated mediawiki packages fix security vulnerability
issue
Updated mediawiki packages fix security vulnerability
issue
Updated mediawiki packages fix security vulnerability
issue
Updated mediawiki packages fix security vulnerability
issue

Browse GCVE Records

73,443 records in the GCVE database · Updated July 18, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›