CVE-2008-5250

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3, when Internet Explorer is used and uploads are enabled, or an SVG scripting browser is used and SVG uploads are enabled, allows remote authenticated users to inject arbitrary web script or HTML by editing a wiki page.

• CWE-79

• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/33133Patch, Vendor Advisory
• http://secunia.com/advisories/33349
• http://www.debian.org/security/2009/dsa-1901
• http://www.securityfocus.com/bid/32844
• https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01256.html
• https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01309.html
• http://lists.opensuse.org/opensuse-security-announce/2009-02/msg00002.html
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2008-December/000080.htmlPatch, Vendor Advisory
• http://secunia.com/advisories/33133Patch, Vendor Advisory
• http://secunia.com/advisories/33349
• http://www.debian.org/security/2009/dsa-1901
• http://www.securityfocus.com/bid/32844
• https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01256.html
• https://www.redhat.com/archives/fedora-package-announce/2008-December/msg01309.html

Published

Dec 19, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-5244Unspecified vulnerability in xine-lib before 1.1.15 has unkn…
• CVE-2008-5245xine-lib before 1.1.15 performs V4L video frame preallocatio…
• CVE-2008-5246Multiple heap-based buffer overflows in xine-lib before 1.1.…
• CVE-2008-5247The real_parse_audio_specific_data function in demux_real.c …
• CVE-2008-5248xine-lib before 1.1.15 allows remote attackers to cause a de…
• CVE-2008-5249Cross-site scripting (XSS) vulnerability in MediaWiki 1.13.0…
• CVE-2008-5252Cross-site request forgery (CSRF) vulnerability in the Speci…
• CVE-2008-5256The AcquireDaemonLock function in ipcdUnix.cpp in Sun Innote…
• CVE-2008-5257webseald in WebSEAL 6.0.0.17 in IBM Tivoli Access Manager fo…
• CVE-2008-5259Integer signedness error in DivX Web Player 1.4.2.7, and pos…
• CVE-2008-5260Heap-based buffer overflow in the CamImage.CamImage.1 Active…
• CVE-2008-5262Multiple stack-based buffer overflows in the iGetHdrHeader f…