CVE-2021-36130

An XSS issue was discovered in the SocialProfile extension in MediaWiki through 1.36. Within several gift-related special pages, a privileged user with the awardmanage right could inject arbitrary HTML and JavaScript within various gift-related data fields. The attack could easily propagate across many pages for many users.

• CWE-79

• https://gerrit.wikimedia.org/r/q/Id915eba45497a1a0dc1c4e00818a2fd4c0ce55d3Patch, Vendor Advisory
• https://phabricator.wikimedia.org/T281043Exploit, Patch, Vendor Advisory
• https://gerrit.wikimedia.org/r/q/Id915eba45497a1a0dc1c4e00818a2fd4c0ce55d3Patch, Vendor Advisory
• https://phabricator.wikimedia.org/T281043Exploit, Patch, Vendor Advisory

Published

Jul 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36125An issue was discovered in the CentralAuth extension in Medi…7.5
• CVE-2021-36126An issue was discovered in the AbuseFilter extension in Medi…9.8
• CVE-2021-36127An issue was discovered in the CentralAuth extension in Medi…4.3
• CVE-2021-36128An issue was discovered in the CentralAuth extension in Medi…9.8
• CVE-2021-36129An issue was discovered in the Translate extension in MediaW…4.3
• CVE-2021-3613OpenVPN Connect 3.2.0 through 3.3.0 allows local users to lo…7.8
• CVE-2021-36131An XSS issue was discovered in the SportsTeams extension in …4.8
• CVE-2021-36132An issue was discovered in the FileImporter extension in Med…8.8
• CVE-2021-36133The OPTEE-OS CSU driver for NXP i.MX SoC devices lacks secur…7.1
• CVE-2021-36134Out of bounds write vulnerability in the JPEG parsing code o…6.5
• CVE-2021-3614A vulnerability was reported on some Lenovo Notebook systems…6.8
• CVE-2021-36143ACRN before 2.5 has a hw/pci/virtio/virtio.c vq_endchains NU…7.5