Threats tagged 'ghsa-jq55-8pqw-g267'

Semantic MediaWiki versions from 3.0.0 up to but not including 7.4.1 contain a stored cross-site scripting (XSS) vulnerability in the Special:Ask feature when using the ElasticStore backend. This flaw allows users with edit permissions to inject malicious scripts via unescaped native_result and score_set outputs. An attacker can embed harmful markup in a Text property or subobject name and then trick other users, including administrators, into visiting a crafted Special:Ask link, resulting in script execution within their sessions.