CVE-2021-39186

GlobalNewFiles is a MediaWiki extension maintained by Miraheze. Prior to commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d, the username column of the GlobalNewFiles special page is vulnerable to a stored XSS. Commit number cee254e1b158cdb0ddbea716b1d3edc31fa4fb5d contains a patch. As a workaround, one may disallow <,> (or other characters required to insert html/js) from being used in account names so an XSS is not possible.

• CWE-20

• https://github.com/miraheze/GlobalNewFiles/commit/cee254e1b158cdb0ddbea716b1d3edc31fa4fb5dPatch, Third Party Advisory
• https://github.com/miraheze/GlobalNewFiles/security/advisories/GHSA-57p5-hqjq-h7vgThird Party Advisory
• https://phabricator.miraheze.org/T7935Exploit, Third Party Advisory
• https://github.com/miraheze/GlobalNewFiles/commit/cee254e1b158cdb0ddbea716b1d3edc31fa4fb5dPatch, Third Party Advisory
• https://github.com/miraheze/GlobalNewFiles/security/advisories/GHSA-57p5-hqjq-h7vgThird Party Advisory
• https://phabricator.miraheze.org/T7935Exploit, Third Party Advisory

Published

Sep 1, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39180OpenOLAT is a web-based learning management system (LMS). A …8.8
• CVE-2021-39181OpenOlat is a web-based learning management system (LMS). Pr…8.8
• CVE-2021-39182EnroCrypt is a Python module for encryption and hashing. Pri…7.5
• CVE-2021-39183Owncast is an open source, self-hosted live video streaming …6.1
• CVE-2021-39184Electron is a framework for writing cross-platform desktop a…8.6
• CVE-2021-39185Http4s is a minimal, idiomatic Scala interface for HTTP serv…9.1
• CVE-2021-39187Parse Server is an open source backend that can be deployed …7.5
• CVE-2021-39189Pimcore is an open source data & experience management platf…5.3
• CVE-2021-3919A potential security vulnerability has been identified in OM…9.8
• CVE-2021-39190The SCCM plugin for GLPI is a plugin to synchronize computer…5.3
• CVE-2021-39191mod_auth_openidc is an authentication/authorization module f…6.1
• CVE-2021-39192Ghost is a Node.js content management system. An error in th…7.2