CVE-2010-2788

Cross-site scripting (XSS) vulnerability in profileinfo.php in MediaWiki before 1.15.5, when wgEnableProfileInfo is enabled, allows remote attackers to inject arbitrary web script or HTML via the filter parameter.

• CWE-79

• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.htmlPatch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.html
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.htmlPatch, Vendor Advisory
• http://openwall.com/lists/oss-security/2010/07/29/4Patch
• http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69952Patch
• http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69984Patch
• http://www.securityfocus.com/bid/42024
• https://bugzilla.redhat.com/show_bug.cgi?id=620225Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=620226Patch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058588.htmlPatch
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/058910.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059232.html
• http://lists.fedoraproject.org/pipermail/package-announce/2011-April/059235.html
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2010-July/000092.htmlPatch, Vendor Advisory
• http://openwall.com/lists/oss-security/2010/07/29/4Patch
• http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69952Patch
• http://svn.wikimedia.org/viewvc/mediawiki?view=revision&revision=69984Patch
• http://www.securityfocus.com/bid/42024
• https://bugzilla.redhat.com/show_bug.cgi?id=620225Patch
• https://bugzilla.redhat.com/show_bug.cgi?id=620226Patch

Published

Apr 27, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2010-2779Cross-site scripting (XSS) vulnerability in WebAccess in Nov…
• CVE-2010-2783IcedTea6 before 1.7.4 allow unsigned apps to read and write …9.1
• CVE-2010-2784The subpage MMIO initialization functionality in the subpage…
• CVE-2010-2785The IRC Protocol component in KVIrc 3.x and 4.x before r4693…
• CVE-2010-2786Directory traversal vulnerability in Piwik 0.6 through 0.6.3…
• CVE-2010-2787api.php in MediaWiki before 1.15.5 does not prevent use of p…
• CVE-2010-2789PHP remote file inclusion vulnerability in MediaWikiParserTe…
• CVE-2010-2790Multiple cross-site scripting (XSS) vulnerabilities in the f…
• CVE-2010-2791mod_proxy in httpd in Apache HTTP Server 2.2.9, when running…
• CVE-2010-2792Race condition in the SPICE (aka spice-xpi) plug-in 2.2 for …
• CVE-2010-2793Race condition in the SPICE (aka spice-activex) plug-in for …
• CVE-2010-2794The SPICE (aka spice-xpi) plug-in 2.2 for Firefox allows loc…