CVE-2012-4377

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.18.5 and 1.19.x before 1.19.2 allows remote attackers to inject arbitrary web script or HTML via a File: link to a nonexistent image.

• CWE-79

• http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Issue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=853409Issue Tracking, Patch
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Vendor Advisory
• https://phabricator.wikimedia.org/T41700Mailing List, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Issue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=853409Issue Tracking, Patch
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Vendor Advisory
• https://phabricator.wikimedia.org/T41700Mailing List, Vendor Advisory

Published

Oct 26, 2017

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4359Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Li…
• CVE-2012-4360Cross-site scripting (XSS) vulnerability in the mod_pagespee…
• CVE-2012-4361lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Vi…
• CVE-2012-4362hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appl…
• CVE-2012-4363Multiple unspecified vulnerabilities in Adobe Reader through…
• CVE-2012-4366Belkin wireless routers Surf N150 Model F7D1301v1, N900 Mode…
• CVE-2012-4378Multiple cross-site scripting (XSS) vulnerabilities in Media…
• CVE-2012-4379MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not s…
• CVE-2012-4380MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows rem…
• CVE-2012-4381MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves pass…8.1
• CVE-2012-4382MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not p…
• CVE-2012-4383contao prior to 2.11.4 has a sql injection vulnerability8.8