CVE-2021-30157

An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Special:Watchlist, some of the rcfilters-filter-* label messages are output in HTML unescaped, leading to XSS.

• CWE-79

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/
• https://phabricator.wikimedia.org/T278058Exploit, Issue Tracking, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/202107-40Third Party Advisory
• https://www.debian.org/security/2021/dsa-4889Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/26UJGHF7LJDOCQN6A3Z4PM7PYRKENJHE/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2OMSV7B2TCFBOCICN3B4SMQP5HVRJQIT/
• https://phabricator.wikimedia.org/T278058Exploit, Issue Tracking, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/202107-40Third Party Advisory
• https://www.debian.org/security/2021/dsa-4889Third Party Advisory

Published

Apr 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-30151Sidekiq through 5.1.3 and 6.x through 6.2.0 allows XSS via t…6.1
• CVE-2021-30152An issue was discovered in MediaWiki before 1.31.13 and 1.32…4.3
• CVE-2021-30153An issue was discovered in the VisualEditor extension in Med…4.3
• CVE-2021-30154An issue was discovered in MediaWiki before 1.31.12 and 1.32…6.1
• CVE-2021-30155An issue was discovered in MediaWiki before 1.31.12 and 1.32…4.3
• CVE-2021-30156An issue was discovered in MediaWiki before 1.31.12 and 1.32…4.3
• CVE-2021-30158An issue was discovered in MediaWiki before 1.31.12 and 1.32…5.3
• CVE-2021-30159An issue was discovered in MediaWiki before 1.31.12 and 1.32…4.3
• CVE-2021-30161An issue was discovered on LG mobile devices with Android OS…5.5
• CVE-2021-30162An issue was discovered on LG mobile devices with Android OS…7.1
• CVE-2021-30163Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers…7.5
• CVE-2021-30164Redmine before 4.0.8 and 4.1.x before 4.1.2 allows attackers…9.8