Mediawiki Userpageviewtracker Extension
Monthly
Unauthenticated SQL injection in the third-party MediaWiki UserPageViewTracker extension allows any remote attacker who can reach a wiki running an affected version to read and exfiltrate arbitrary data from the MediaWiki database backend. The flaw is present in all versions of the extension before the vendor's fixed releases 1.46.1, 1.45.5, and 1.43.10, and per the CVSS vector (AV:N/AC:L/PR:N/UI:N) requires no authentication or user interaction; impact is confined to confidentiality (C:H) with no asserted integrity or availability effect. Publicly available exploit code exists according to the CISA SSVC assessment (Exploitation: poc), but there is no KEV listing and no confirmed active exploitation, and the EPSS score is low at 0.16% (5th percentile), consistent with a genuine but moderate-priority issue whose real-world exposure is limited by the fact that the extension is optional and absent from default MediaWiki installs.
Unauthenticated SQL injection in the third-party MediaWiki UserPageViewTracker extension allows any remote attacker who can reach a wiki running an affected version to read and exfiltrate arbitrary data from the MediaWiki database backend. The flaw is present in all versions of the extension before the vendor's fixed releases 1.46.1, 1.45.5, and 1.43.10, and per the CVSS vector (AV:N/AC:L/PR:N/UI:N) requires no authentication or user interaction; impact is confined to confidentiality (C:H) with no asserted integrity or availability effect. Publicly available exploit code exists according to the CISA SSVC assessment (Exploitation: poc), but there is no KEV listing and no confirmed active exploitation, and the EPSS score is low at 0.16% (5th percentile), consistent with a genuine but moderate-priority issue whose real-world exposure is limited by the fact that the extension is optional and absent from default MediaWiki installs.