REDAXO versions before 5.21.5 have a cross-site request forgery (CSRF) vulnerability in the backend. The vulnerability arises because the safemode GET parameter in index.php is processed without validating a CSRF token. An attacker can exploit this by tricking a logged-in administrator into clicking a crafted link, which can disable global safe mode or enable session safe mode, potentially impacting backend addon functionality.
REDAXO core versions before 5.21.4 have a missing authorization vulnerability in the structure/version and structure/history frontend preview modes. These modes fail to verify category or clang permissions for the previewed article, allowing any backend user or users with the history[article_rollback] permission to access unpublished, historic, or deleted content by manipulating preview parameters.
REDAXO versions before 5.21.5 have a missing authorization vulnerability in the backup addon export feature. This flaw allows non-admin users with the backup[export] permission to export any database table, including sensitive tables such as rex_user and rex_user_session. Exploitation can lead to attackers obtaining plaintext session IDs and stay-logged-in keys to hijack admin accounts or password hashes for offline cracking.
SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious markup via the search parameter in the extended Special:Search profile. The vulnerability arises because the ProfileForm::profile_sheet function inserts unescaped user input into a pre element, enabling script execution in the context of the wiki origin when crafted URLs with SVG event handlers are used.
SemanticMediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious script via Code-typed property values. The vulnerability arises because attackers can embed HTML markup inside a valid JSON value, which is then rendered unescaped on the Special:Browse page, leading to JavaScript execution in the browsers of users viewing the page.
REDAXO core versions prior to 5.21.5 have a missing authorization vulnerability in the rex_api_package API function. This flaw allows non-admin backend users who possess a valid CSRF token to manage packages, including uninstalling system addons, deactivating, installing, activating, or deleting packages. Attackers with such tokens, for example demoted admins with active sessions, can cause significant disruption such as dropping database tables of system addons.
SemanticMediaWiki versions from 4.2.0 up to but not including 7.2.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious HTML and execute scripts in users' browsers via crafted URLs targeting the Special:FacetedSearch page. The vulnerability arises from unescaped cstate parameters that break out of hidden input attributes. The CVSS 3.1 base score is 6.1, indicating a medium severity issue.
REDAXO versions prior to 5.21.5 have a vulnerability related to insufficient session expiration. This flaw allows attackers who have obtained a user's session ID or stay-logged-in cookie to maintain backend access even after the user changes their password. The stay-logged-in cookie remains valid for up to three months, enabling prolonged unauthorized access.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.0 have a missing authorization vulnerability in the api.php smwtask module. This flaw allows unauthenticated attackers to perform admin-only maintenance tasks by leveraging the public anonymous CSRF token. Exploitation can lead to reading internal store statistics, enqueuing jobs such as smw.entityIdDisposer, and executing these jobs, which may degrade system performance and alter semantic data.
SemanticMediaWiki versions from 3.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with the smw-schemaedit permission to inject malicious script code via the canonical_name property of a property group schema. The injected script is rendered unescaped in Special:Browse headings by GroupFormatter, leading to JavaScript execution in the context of viewers, including administrators.
Semantic MediaWiki versions from 4.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with profile or schema editing permissions to inject malicious HTML through FacetedSearch exploration-link labels. The injected markup is passed unescaped to the page rendering function, potentially enabling script execution in the browsers of users viewing the affected Special:FacetedSearch page.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious scripts via External identifier property values. The injected scripts are rendered unescaped on the Special:Browse page, enabling execution of JavaScript in the context of viewers' sessions, including administrators. The vulnerability has a medium severity rating with a CVSS score of 5.4.
SemanticMediaWiki versions from 5.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability in the ext.smw.tooltip.tippy.js component. This vulnerability arises because data-* attributes are rendered via innerHTML with allowHTML enabled, allowing editors to inject malicious JavaScript through specially crafted .smw-highlighter spans. When other users, including administrators, hover over these elements, the malicious script executes.
Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with the smw-schemaedit permission to inject malicious HTML code via schema descriptions. The injected HTML is rendered unescaped, enabling alteration of pages and potential targeting of users who view the affected schema pages.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious HTML via Keyword-typed property values that are rendered without proper escaping on the Special:Browse page. Exploitation can lead to execution of JavaScript in the context of other users' sessions, including administrators, potentially enabling token theft and unauthorized actions.
Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:SMWAdmin ID lookup feature. This vulnerability allows unauthenticated attackers to inject malicious markup via the unescaped 'id' parameter. By tricking an administrator into clicking a crafted link, attackers can bypass the auto-satisfied edit-token check and execute scripts within the administrator's session, potentially performing privileged actions.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to inject malicious markup into semantic property values that are rendered unescaped in autocomplete suggestions. When a user opens the property-value autocomplete with an empty query, the vulnerable JavaScript concatenates raw API values into HTML, potentially executing arbitrary scripts.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a cross-site request forgery (CSRF) vulnerability in the Special:SMWAdmin page. This vulnerability allows an attacker to trick an authenticated smw-admin user into performing unintended actions such as schema setup, entity disposal, or job execution. Exploitation can result in semantic data loss and resource exhaustion.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a vulnerability that allows anonymous attackers to cause excessive resource consumption. By sending repeated requests to the Special:PropertyLabelSimilarity page with a limit parameter set to zero, attackers can bypass SQL limits and trigger quadratic computations. This leads to exhaustion of PHP CPU, memory, and database connections, resulting in a denial of service condition.
Semantic MediaWiki versions from 7.3.0 up to but not including 7.3.1 have a missing authorization vulnerability in the smwtask update task. This flaw allows users with edit rights to force semantic updates on arbitrary pages, potentially causing resource-intensive operations and unauthorized semantic-store writes.