CVE-2025-53487
ApprovedRevs: Stored Cross-Site Scripting (XSS) via unsanitized system messages
Vexday Risk Score
13Baixo
Decisão SSVC (CISA)
Track
Sem sinal de exploração → monitorar
CVSS 5.4EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
07 jul 2025Publicada no NVD
Recomendação: Monitorar — sem sinal de exploração no momento.
The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper escaping. Attackers can exploit this by injecting JavaScript payloads via the uselang=x-xss language override, which causes crafted message keys to be rendered unescaped.
This issue affects Mediawiki - ApprovedRevs extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
Wikimedia Foundation · Mediawiki - ApprovedRevs extensionQuer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →