Product by The Wikimedia Foundation
Mediawiki - Cargo Extension
13 known vulnerabilities in Mediawiki - Cargo Extension (The Wikimedia Foundation), 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-58521 | SQLi in Cargo extension via year range filter | 9.8 | |
| Critical | CVE-2026-14363 | Cargo Extension: SQLi in Special:Drilldown | 9.8 | |
| Medium | CVE-2026-96878 | Cargo Exhibit field alias allows stored XSS | — | |
| Medium | CVE-2026-96876 | Anonymous reflected XSS in CargoExport invalid-alias errors | — | |
| Medium | CVE-2026-96877 | Reflected XSS through Cargo Drilldown full-text search | — | |
| Medium | CVE-2026-96875 | Reflected XSS in Cargo Drilldown hierarchy filters | — | |
| Medium | CVE-2026-96879 | The Wikimedia Foundation Mediawiki - FlaggedRevs extension: Improper Removal of Sensitive Information Before Storage or Transfer | — | |
| Medium | CVE-2025-62671 | Stored XSS through wikitext in Cargo | — | |
| Medium | CVE-2026-103049 | XSS in Cargo's Special:CargoQuery page due to unsanitized table headers | 6.1 | |
| Medium | CVE-2026-100237 | Stored i18n XSS in the Flow integration of Thanks | 6.1 | |
| Medium | CVE-2026-58519 | Stored XSS through Cargo's map format | 5.4 | |
| Low | CVE-2026-96874 | Stored XSS in Cargo Drilldown tab names | — | |
| Low | CVE-2025-62655 | SQL injection in Cargo via Special:CargoExport | — |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 26sans-atrisk-mail,