Threats tagged 'ghsa-3cxg-pq55-vhm5'

CVE-2026-103044 is a critical XML injection vulnerability, also known as blind XPath injection, in the Mediawiki EasyTimeline extension maintained by The Wikimedia Foundation. This flaw allows attackers to inject malicious XML content, potentially impacting confidentiality, integrity, and availability. The vulnerability affects versions before 1.43.10, 1.45.5, and 1.46.1 of the EasyTimeline extension. It has a high CVSS score of 9.8, indicating severe risk if exploited.