A flaw was found in the MediaWiki CentralNotice extension. Due to improper input neutralization during web page generation, an attacker can inject malicious code into stored application notices. When a user views the affected page, this script executes within their web browser, potentially leading to sensitive information disclosure or unauthorized actions performed on their behalf.
Last checked: 2026-09-30 22:14 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 18:14 UTC)
Fix evidence last checked: 2026-09-30 12:02 UTC