CVE-2012-1582

Cross-site scripting (XSS) vulnerability in the wikitext parser in MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 allows remote attackers to inject arbitrary web script or HTML via a crafted page with "forged strip item markers," as demonstrated using the CharInsert extension.

• CWE-79

• http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.htmlVendor Advisory
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.htmlVendor Advisory
• http://osvdb.org/80363
• http://secunia.com/advisories/48504Vendor Advisory
• http://www.openwall.com/lists/oss-security/2012/03/22/9
• http://www.openwall.com/lists/oss-security/2012/03/24/1
• http://www.securityfocus.com/bid/52689
• https://bugzilla.wikimedia.org/show_bug.cgi?id=35315
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74288
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000109.htmlVendor Advisory
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2012-March/000110.htmlVendor Advisory
• http://osvdb.org/80363
• http://secunia.com/advisories/48504Vendor Advisory
• http://www.openwall.com/lists/oss-security/2012/03/22/9
• http://www.openwall.com/lists/oss-security/2012/03/24/1
• http://www.securityfocus.com/bid/52689
• https://bugzilla.wikimedia.org/show_bug.cgi?id=35315
• https://exchange.xforce.ibmcloud.com/vulnerabilities/74288

Published

Sep 9, 2012

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-1576The myuser_delete function in libathemecore/account.c in Ath…
• CVE-2012-1577lib/libc/stdlib/random.c in OpenBSD returns 0 when seeded wi…9.8
• CVE-2012-1578Multiple cross-site request forgery (CSRF) vulnerabilities i…
• CVE-2012-1579The resource loader in MediaWiki 1.17.x before 1.17.3 and 1.…
• CVE-2012-1580Cross-site request forgery (CSRF) vulnerability in Special:U…
• CVE-2012-1581MediaWiki 1.17.x before 1.17.3 and 1.18.x before 1.18.2 uses…
• CVE-2012-1583Double free vulnerability in the xfrm6_tunnel_rcv function i…
• CVE-2012-1584Integer overflow in the mid function in toolkit/tbytevector.…
• CVE-2012-1585OpenStack Compute (Nova) Essex before 2011.3 allows remote a…
• CVE-2012-1586mount.cifs in cifs-utils 2.6 allows local users to determine…
• CVE-2012-1587Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2012-1588Algorithmic complexity vulnerability in the _filter_url func…