Threats tagged 'ghsa-xhv2-855h-ph3c'

SemanticMediaWiki versions from 3.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with the smw-schemaedit permission to inject malicious script code via the canonical_name property of a property group schema. The injected script is rendered unescaped in Special:Browse headings by GroupFormatter, leading to JavaScript execution in the context of viewers, including administrators.