Semantic MediaWiki EUVD-2026-83173

Requires a Semantic MediaWiki instance at version <= 7.1.0 with the Special:SearchByProperty page reachable by the attacker's target (default for the extension). Exploitation requires victim user interaction (UI:R): the target must open an attacker-crafted URL carrying the payload in the property or value parameter. No authentication is required to construct or serve the malicious link (PR:N), but real impact depends on the victim being a logged-in wiki user whose session the injected script can abuse. Limiting factors: reflected (non-persistent) nature means each victim must be individually lured, and impact is confined to the victim's browser context (no server-side code execution).

This is a legitimate but moderate-priority web vulnerability. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) is the textbook signature of a reflected XSS: network-reachable, low complexity, no privileges, but requiring victim interaction. No EPSS score, KEV listing, or public exploit code is present in the provided intelligence - so this is not a confirmed-exploited or mass-exploitation candidate. The impact is bounded (C:L/I:L, A:N): a successful attack executes script in the victim's browser session but does not directly compromise the server or provide code execution. Reflected XSS also lacks the persistence of stored XSS, requiring a social-engineering lure per victim. Net: a real, patch-worthy issue for any exposed Semantic MediaWiki wiki, but not an emergency relative to unauthenticated RCE-class bugs. No conflicting signals were observed between the CVSS vector and the description - both consistently describe a remote, interaction-dependent reflected XSS.

An attacker crafts a URL to a target wiki's Special:SearchByProperty page with a malicious payload in the value (or property) parameter, which is reflected unescaped into the rendered form field or into a derived error message. The attacker delivers this link to an authenticated wiki user (e.g., an admin) via email or chat; when the victim opens it, the injected script runs in their session and can steal session cookies, forge edits, or perform actions as that user. No public exploit code is identified in the provided data, though the payload is trivial to construct given the described reflection points.