CVE-2024-25107

WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the `Language::date` function is used when making the human-readable timestamp for inclusion on the wiki_creation column. This function uses interface messages to translate the names of months and days. It uses the `->text()` output mode, returning unescaped interface messages. Since the output is not escaped later, the unescaped interface message is included on the output, resulting in an XSS vulnerability. Exploiting this on-wiki requires the `(editinterface)` right. This vulnerability has been addressed in commit `267e763a0`. Users are advised to update their installations. There are no known workarounds for this vulnerability.

• CWE-79

• https://github.com/miraheze/WikiDiscover/commit/267e763a0d7460f001693c42f67717a0fc3fd6bbPatch
• https://github.com/miraheze/WikiDiscover/security/advisories/GHSA-cfcf-94jv-455fPatch, Vendor Advisory
• https://issue-tracker.miraheze.org/T11814Issue Tracking, Vendor Advisory
• https://github.com/miraheze/WikiDiscover/commit/267e763a0d7460f001693c42f67717a0fc3fd6bbPatch
• https://github.com/miraheze/WikiDiscover/security/advisories/GHSA-cfcf-94jv-455fPatch, Vendor Advisory
• https://issue-tracker.miraheze.org/T11814Issue Tracking, Vendor Advisory

Published

Feb 8, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-25099Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-25100Deserialization of Untrusted Data vulnerability in WP Swings…9.8
• CVE-2024-25101Improper Neutralization of Input During Web Page Generation …4.8
• CVE-2024-25102This vulnerability exists in AppSamvid software due to the u…7.8
• CVE-2024-25103This vulnerability exists in AppSamvid software due to the u…6.3
• CVE-2024-25106OpenObserve is a observability platform built specifically f…6.5
• CVE-2024-25108Pixelfed is an open source photo sharing platform. When proc…8.8
• CVE-2024-25109ManageWiki is a MediaWiki extension allowing users to manage…5.4
• CVE-2024-2511Issue summary: Some non-default TLS server configurations ca…5.9
• CVE-2024-25110The UAMQP is a general purpose C library for AMQP 1.0. Durin…8.1
• CVE-2024-25111Squid is a web proxy cache. Starting in version 3.5.27 and p…7.5
• CVE-2024-25112Exiv2 is a command-line utility and C++ library for reading,…5