NetSight
IP …
medium5.3

CVE-2025-23081

Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS)

Impact

Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Affected packages

EcosystemPackageAffectedFixed in
composermediawiki/data-transfer>= 1.39.0, < 1.39.111.39.11

Affected products

ProductAffected versions
Mediawiki - DataTransfer Extension: From 1.39.X
before 1.39.11
From 1.41.X
before 1.41.3
From 1.42.X
before 1.42.2.

Versions were read from the advisory text. No structured product data has been published for this record yet.

Weakness classification

CWE-79CWE-352

References