CVE-2024-47782

WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that lists all wikis on the wiki farm. However, the special page does not make any effort to escape the wiki name or description. Therefore, if a wiki sets its name and/or description to an XSS payload, the XSS will execute whenever the wiki is shown on Special:WikiDiscover. This issue has been patched with commit `2ce846dd93` and all users are advised to apply that patch. User unable to upgrade should block access to `Special:WikiDiscover`.

• CWE-79
• CWE-80

• https://github.com/miraheze/WikiDiscover/commit/2ce846dd93ddb9ec86f7472c4d57fe71a09dc827Patch
• https://github.com/miraheze/WikiDiscover/security/advisories/GHSA-wf48-rqx3-39mfVendor Advisory
• https://issue-tracker.miraheze.org/T12697Issue Tracking, Product

Published

Oct 7, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47777GStreamer is a library for constructing graphs of media-hand…9.1
• CVE-2024-47778GStreamer is a library for constructing graphs of media-hand…7.5
• CVE-2024-47779Element is a Matrix web client built using the Matrix React …7
• CVE-2024-4778Memory safety bugs present in Firefox 125. Some of these bug…9.8
• CVE-2024-47780TYPO3 is a free and open source Content Management Framework…4.3
• CVE-2024-47781CreateWiki is an extension used at Miraheze for requesting &…6.1
• CVE-2024-47783A vulnerability has been identified in SIPORT (All versions …7.8
• CVE-2024-47784Unverified Password Change for ANC software that allows an a…2.6
• CVE-2024-47789** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in…8.7
• CVE-2024-4779The Unlimited Elements For Elementor (Free Widgets, Addons, …8.8
• CVE-2024-47790** UNSUPPORTED WHEN ASSIGNED ** This vulnerability exists in…8.7
• CVE-2024-47791Ruijie Reyee OS versions 2.206.x up to but not including 2.3…5.3