rootpwn

medium · CVSS v3 6.1

CVE-2026-77607

Semantic MediaWiki prior to version 7.2.0 contains an HTML injection vulnerability in the handling of the 'sep' parameter. The separator val

Overview

Semantic MediaWiki prior to version 7.2.0 contains an HTML injection vulnerability in the handling of the 'sep' parameter. The separator value is inserted verbatim into HTML cell joins without proper sanitization. This matters because it allows attackers to inject arbitrary HTML into wiki pages, potentially leading to client-side attacks.

Description

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, `sep` was inserted verbatim into HTML cell joins. This made it possible to inject HTML through the separator value. Version 7.2.0 fixes the issue.

Impact

This vulnerability impacts the integrity and confidentiality of users viewing affected wiki pages through potential client-side execution. Authenticated or unauthenticated users capable of manipulating query parameters may inject malicious HTML. Administrators and regular wiki users relying on rendered page content are at risk.

Remediation

Upgrade Semantic MediaWiki to version 7.2.0 or later to ensure the 'sep' parameter is properly sanitized. Review existing wiki templates and queries that utilize custom separator values for unexpected HTML content.

Risk context

The vulnerability is rated as medium severity with a CVSS v3 score of 6.1. EPSS data is currently unavailable. Remediation should be scheduled during standard maintenance windows.

Affected products

  • Semantic MediaWiki < 7.2.0

Scores

Severity
medium
CVSS v2
6.4
CVSS v3
6.1
CVSS v4
—
EPSS
—

MediaWiki Semantic MediaWiki HTML Injection Web Application Input Sanitization

← All CVEs

Related CVEs

medium

CVE-2026-77875

A vulnerability exists in the application where sensitive vault data and media files stored on shared external storage are not cryptographically bound to the authentication boundary. A local attacker with auxiliary storage access can directly copy the underlying SQLite database and files, completely bypassing the calculator passcode. This matters because it invalidates the primary privacy mechanism expected by users of secure vault applications.

View analysis

medium

CVE-2026-93921

SiYuan up to version 3.8.4 contains an access control vulnerability in the getDynamicIcon endpoint. The flaw allows read-only token holders to bypass restrictions and retrieve sensitive document metadata using template injection.

View analysis

medium

CVE-2026-77820

The WPComplete plugin for WordPress up to version 2.9.9.0 contains a Stored Cross-Site Scripting vulnerability within the 'empty' shortcode attribute. This flaw arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level privileges or higher to inject malicious scripts into pages. The vulnerability exclusively affects the premium version of the plugin and executes whenever a victim views the affected page.

View analysis

medium

CVE-2026-93312

A null pointer dereference in Poppler 26.07.0’s JBIG2Stream::rewind can be triggered remotely, causing a crash in PDF rendering. The flaw is limited to the Poppler library and does not directly expose data. Updating to 26.08.0 mitigates the issue.

View analysis