The Wikimedia Foundation Mediawiki - Cargo extension vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 14 published in the last 12 months.

Latest The Wikimedia Foundation Mediawiki - Cargo extension vulnerabilities

CVE-2026-103049 — XSS in Cargo's Special:CargoQuery page due to unsanitized table headers (CVSS 6.1)
CVE-2026-96878 — Cargo Exhibit field alias allows stored XSS (CVSS 6.9)
CVE-2026-96877 — Reflected XSS through Cargo Drilldown full-text search (CVSS 6.9)
CVE-2026-96876 — Anonymous reflected XSS in CargoExport invalid-alias errors (CVSS 6.9)
CVE-2026-96875 — Reflected XSS in Cargo Drilldown hierarchy filters (CVSS 6.9)
CVE-2026-96874 — Stored XSS in Cargo Drilldown tab names (CVSS 2.3)
CVE-2026-14363 — Cargo Extension: SQLi in Special:Drilldown (CVSS 9.8)
CVE-2026-58521 — SQLi in Cargo extension via year range filter (CVSS 9.8)
CVE-2026-58519 — Stored XSS through Cargo's map format (CVSS 5.4)
CVE-2026-39841 — Stored XSS through list fields on Cargo's page values and Special:CargoTables (CVSS 6.1)
CVE-2026-39840 — CSS injection in multiple Cargo display formats (CVSS 6.1)
CVE-2026-39839 — Stored XSS through URLs in Cargo's map format (CVSS 6.1)
CVE-2026-39837 — Stored XSS through the dynamic table format in Cargo (CVSS 5.4)
CVE-2025-62671 — Stored XSS through wikitext in Cargo (CVSS 6.9)
CVE-2024-47849 — Backticks can allow the usage of not-allowed SQL functions (CVSS 9.8)
CVE-2024-47847 — Various XSSes found in Cargo (CVSS 6.1)
CVE-2024-47846 — Special:DeleteCargoTable and Special:SwitchCargoTable have no CSRF protection (CVSS 8.8)