CVE-2021-42041

An issue was discovered in CentralAuth in MediaWiki through 1.36.2. The rightsnone MediaWiki message was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the setchange log.

• CWE-79

• https://gerrit.wikimedia.org/r/q/I7aeaa6e4de5ccaa5eeb6bf4fb00c96b01d5fea35Patch, Vendor Advisory
• https://phabricator.wikimedia.org/T291696Exploit, Patch, Vendor Advisory
• https://gerrit.wikimedia.org/r/q/I7aeaa6e4de5ccaa5eeb6bf4fb00c96b01d5fea35Patch, Vendor Advisory
• https://phabricator.wikimedia.org/T291696Exploit, Patch, Vendor Advisory

Published

Oct 6, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42027A vulnerability has been identified in SINUMERIK Edge (All v…7.4
• CVE-2021-42028A vulnerability has been identified in syngo fastView (All v…7.8
• CVE-2021-42029A vulnerability has been identified in SIMATIC STEP 7 (TIA P…7.8
• CVE-2021-4203A use-after-free read flaw was found in sock_getsockopt() in…6.8
• CVE-2021-4204An out-of-bounds (OOB) memory access flaw was found in the L…7.1
• CVE-2021-42040An issue was discovered in MediaWiki through 1.36.2. A parse…7.5
• CVE-2021-42042An issue was discovered in SpecialEditGrowthConfig in the Gr…4.8
• CVE-2021-42043An issue was discovered in Special:MediaSearch in the MediaS…6.1
• CVE-2021-42044An issue was discovered in the Mentor dashboard in the Growt…4.8
• CVE-2021-42045An issue was discovered in SecurePoll in the Growth extensio…5.4
• CVE-2021-42046An issue was discovered in the GlobalWatchlist extension in …6.1
• CVE-2021-42047An issue was discovered in the Growth extension in MediaWiki…5.4