CVE-2022-34912

An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped.

• https://lists.debian.org/debian-lts-announce/2022/09/msg00027.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/
• https://phabricator.wikimedia.org/T308473Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/202305-24
• https://www.debian.org/security/2022/dsa-5246Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/09/msg00027.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B/
• https://phabricator.wikimedia.org/T308473Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/202305-24
• https://www.debian.org/security/2022/dsa-5246Third Party Advisory

Published

Jul 2, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-34907An authentication bypass vulnerability exists in FileWave be…9.8
• CVE-2022-34908An issue was discovered in the A4N (Aremis 4 Nomad) applicat…7.5
• CVE-2022-34909An issue was discovered in the A4N (Aremis 4 Nomad) applicat…9.1
• CVE-2022-3491Heap-based Buffer Overflow in GitHub repository vim/vim prio…7.8
• CVE-2022-34910An issue was discovered in the A4N (Aremis 4 Nomad) applicat…5.5
• CVE-2022-34911An issue was discovered in MediaWiki before 1.35.7, 1.36.x a…6.1
• CVE-2022-34913md2roff 1.7 has a stack-based buffer overflow via a Markdown…9.8
• CVE-2022-34914Webswing before 22.1.3 allows X-Forwarded-For header injecti…9.8
• CVE-2022-34916Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to…9.8
• CVE-2022-34917A security vulnerability has been identified in Apache Kafka…7.5
• CVE-2022-34918An issue was discovered in the Linux kernel through 5.18.9. …7.8
• CVE-2022-34919The file upload wizard in Zengenti Contensis Classic before …9.8