CVE-2024-47781

CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped on Special:RequestWikiQueue, so a user can insert arbitrary HTML that is displayed in the request wiki queue when requesting a wiki. If a wiki creator comes across the XSS payload, their user session can be abused to retrieve deleted wiki requests, which typically contains private information. Likewise, this can also be abused on those with the ability to suppress requests to view sensitive information. This issue has been patched with commit `693a220` and all users are advised to apply the patch. Users unable to upgrade should disable Javascript and/or prevent access to the vulnerable page (Special:RequestWikiQueue).

• CWE-79

• https://github.com/miraheze/CreateWiki/commit/693a220f399ee7eb4d00e77c3c667e864b1bd306Patch
• https://github.com/miraheze/CreateWiki/security/advisories/GHSA-h527-jh77-5g7jVendor Advisory
• https://issue-tracker.miraheze.org/T12693Issue Tracking, Product

Published

Oct 7, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47776GStreamer is a library for constructing graphs of media-hand…9.1
• CVE-2024-47777GStreamer is a library for constructing graphs of media-hand…9.1
• CVE-2024-47778GStreamer is a library for constructing graphs of media-hand…7.5
• CVE-2024-47779Element is a Matrix web client built using the Matrix React …7
• CVE-2024-4778Memory safety bugs present in Firefox 125. Some of these bug…9.8
• CVE-2024-47780TYPO3 is a free and open source Content Management Framework…4.3
• CVE-2024-47782WikiDiscover is an extension designed for use with a CreateW…5.4
• CVE-2024-47783A vulnerability has been identified in SIPORT (All versions …7.8
• CVE-2024-47784Unverified Password Change for ANC software that allows an a…2.6
• CVE-2024-47789** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in…8.7
• CVE-2024-4779The Unlimited Elements For Elementor (Free Widgets, Addons, …8.8
• CVE-2024-47790** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in…8.7