CVE-2014-2242

includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.

• CWE-79

• http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.htmlPatch, Vendor Advisory
• http://openwall.com/lists/oss-security/2014/02/28/1
• http://openwall.com/lists/oss-security/2014/03/01/2
• http://www.securityfocus.com/bid/65910
• https://bugzilla.redhat.com/show_bug.cgi?id=1071135
• https://bugzilla.wikimedia.org/show_bug.cgi?id=60771Vendor Advisory
• https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb%2Cn%2Cz
• http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.htmlPatch, Vendor Advisory
• http://openwall.com/lists/oss-security/2014/02/28/1
• http://openwall.com/lists/oss-security/2014/03/01/2
• http://www.securityfocus.com/bid/65910
• https://bugzilla.redhat.com/show_bug.cgi?id=1071135
• https://bugzilla.wikimedia.org/show_bug.cgi?id=60771Vendor Advisory
• https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb%2Cn%2Cz

Published

Mar 2, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-2235Cross-site scripting (XSS) vulnerability in Askbot before 0.…
• CVE-2014-2236Multiple cross-site scripting (XSS) vulnerabilities in Askbo…
• CVE-2014-2237The memcache token backend in OpenStack Identity (Keystone) …
• CVE-2014-2238SQL injection vulnerability in the manage configuration page…
• CVE-2014-2240Stack-based buffer overflow in the cf2_hintmap_build functio…
• CVE-2014-2241The (1) cf2_initLocalRegionBuffer and (2) cf2_initGlobalRegi…
• CVE-2014-2243includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.…
• CVE-2014-2244Cross-site scripting (XSS) vulnerability in the formatHTML f…
• CVE-2014-2245SQL injection vulnerability in the News module in CMS Made S…
• CVE-2014-2246Cross-site scripting (XSS) vulnerability in the integrated w…
• CVE-2014-2247The integrated web server on Siemens SIMATIC S7-1500 CPU PLC…
• CVE-2014-2248Open redirect vulnerability in the integrated web server on …