CVE-2012-4378

Multiple cross-site scripting (XSS) vulnerabilities in MediaWiki before 1.18.5 and 1.19.x before 1.19.2, when unspecified JavaScript gadgets are used, allow remote attackers to inject arbitrary web script or HTML via the userlang parameter to w/index.php.

• CWE-79

• http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Issue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=853417Issue Tracking, Patch, Third Party Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Vendor Advisory
• https://phabricator.wikimedia.org/T39587Issue Tracking, Patch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Issue Tracking, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=853417Issue Tracking, Patch, Third Party Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Vendor Advisory
• https://phabricator.wikimedia.org/T39587Issue Tracking, Patch, Vendor Advisory

Published

Oct 26, 2017

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2012-4360Cross-site scripting (XSS) vulnerability in the mod_pagespee…
• CVE-2012-4361lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Vi…
• CVE-2012-4362hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appl…
• CVE-2012-4363Multiple unspecified vulnerabilities in Adobe Reader through…
• CVE-2012-4366Belkin wireless routers Surf N150 Model F7D1301v1, N900 Mode…
• CVE-2012-4377Cross-site scripting (XSS) vulnerability in MediaWiki before…
• CVE-2012-4379MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not s…
• CVE-2012-4380MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows rem…
• CVE-2012-4381MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves pass…8.1
• CVE-2012-4382MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not p…
• CVE-2012-4383contao prior to 2.11.4 has a sql injection vulnerability8.8
• CVE-2012-4384letodms has multiple XSS issues: Reflected XSS in Login Page…6.1