Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.23.10, 1.24.x before 1.24.3, and 1.25.x before 1.25.2 allows remote attackers to inject arbitrary web script or HTML via the rel404 parameter, which is not properly handled in an error page.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Freebsd | — | Upgrade mediawiki123Upgrade mediawiki125Upgrade mediawiki124 | Dec 10, 2025 | Aug 14, 2015 |
| Gentoo Linux | — | Upgrade www-apps/mediawiki. | Oct 30, 2017 | Sep 1, 2015 |
| Mediawiki | — | Upgrade MediaWiki to the latest version | Aug 24, 2017 | Sep 1, 2015 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub