Threats affecting pkg:github/mediawiki/extensions/Cargo

A reflected cross-site scripting (XSS) vulnerability exists in the Wikimedia Foundation's Mediawiki Cargo extension before version 1.46.1. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts into web pages. No CVSS score is provided for this vulnerability. The issue is classified as high severity due to the potential impact of XSS attacks. A fix is available in version 1.46.1.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in the Mediawiki - Cargo extension allows Stored XSS. This issue affects Mediawiki - Cargo extension: through 3.9.4.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS. This issue affects Mediawiki - Cargo Extension: from * before 3.9.1.

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Wikimedia Foundation Mediawiki - Cargo Extension allows Stored XSS.This issue affects Mediawiki - Cargo Extension: before 3.8.7.

An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.