CVE-2013-4303

includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-site scripting (XSS) attacks via the siprop parameter in a query action to wiki/api.php.

• CWE-79

• http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.htmlMailing List, Patch, Vendor Advisory
• http://seclists.org/oss-sec/2013/q3/553Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/62194Third Party Advisory, VDB Entry
• https://bugzilla.wikimedia.org/show_bug.cgi?id=52746Exploit, Issue Tracking, Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86897Third Party Advisory, VDB Entry
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2013-September/000133.htmlMailing List, Patch, Vendor Advisory
• http://seclists.org/oss-sec/2013/q3/553Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/62194Third Party Advisory, VDB Entry
• https://bugzilla.wikimedia.org/show_bug.cgi?id=52746Exploit, Issue Tracking, Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/86897Third Party Advisory, VDB Entry

Published

Dec 11, 2019

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-4297The virFileNBDDeviceAssociate function in util/virfile.c in …
• CVE-2013-4298The ReadGIFImage function in coders/gif.c in ImageMagick bef…
• CVE-2013-4299Interpretation conflict in drivers/md/dm-snap-persistent.c i…
• CVE-2013-4300The scm_check_creds function in net/core/scm.c in the Linux …
• CVE-2013-4301includes/resourceloader/ResourceLoaderContext.php in MediaWi…
• CVE-2013-4302(1) ApiBlock.php, (2) ApiCreateAccount.php, (3) ApiLogin.php…
• CVE-2013-4304The CentralAuth extension for MediaWiki 1.19.x before 1.19.8…
• CVE-2013-4305Cross-site scripting (XSS) vulnerability in contrib/example.…
• CVE-2013-4306Cross-site request forgery (CSRF) vulnerability in api/ApiQu…
• CVE-2013-4307Multiple cross-site scripting (XSS) vulnerabilities in repo/…
• CVE-2013-4308Cross-site scripting (XSS) vulnerability in pages/TalkpageHi…
• CVE-2013-4309Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…