Threats tagged 'ghsa-xq8g-94p2-h527'

SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious markup via the search parameter in the extended Special:Search profile. The vulnerability arises because the ProfileForm::profile_sheet function inserts unescaped user input into a pre element, enabling script execution in the context of the wiki origin when crafted URLs with SVG event handlers are used.