CVE-2024-47612

DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (datadump-table-column-in-progress), (datadump-table-column-completed), (datadump-table-column-failed)). If these messages are edited (which requires the (editinterface) right by default), anyone who can view Special:DataDump (which requires the (view-dump) right by default) can be XSSed. This vulnerability is fixed with 601688ee8e8808a23b102fa305b178f27cbd226d.

• CWE-79
• CWE-80

• https://github.com/miraheze/DataDump/commit/601688ee8e8808a23b102fa305b178f27cbd226d.patch
• https://github.com/miraheze/DataDump/security/advisories/GHSA-h8x8-24c7-r2rj
• https://issue-tracker.miraheze.org/T12670

Published

Oct 2, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47607GStreamer is a library for constructing graphs of media-hand…9.8
• CVE-2024-47608Logicytics is designed to harvest and collect data for foren…9.8
• CVE-2024-47609Tonic is a native gRPC client & server implementation with a…6.9
• CVE-2024-4761Out of bounds write in V8 in Google Chrome prior to 124.0.63…8.8
• CVE-2024-47610InvenTree is an Open Source Inventory Management System. In …5.4
• CVE-2024-47611XZ Utils provide a general-purpose data-compression library …6.3
• CVE-2024-47613GStreamer is a library for constructing graphs of media-hand…9.8
• CVE-2024-47614async-graphql is a GraphQL server library implemented in Rus…7.5
• CVE-2024-47615GStreamer is a library for constructing graphs of media-hand…9.8
• CVE-2024-47616Pomerium is an identity and context-aware access proxy. The …6.8
• CVE-2024-47617Sulu is a PHP content management system. This vulnerability …6.1
• CVE-2024-47618Sulu is a PHP content management system. Sulu is vulnerable …5.4