CVE-2025-21612 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.

Reserved 2024-12-29 | Published 2025-01-06 | Updated 2025-01-06 | Assigner GitHub_M

HIGH: 8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Product status

>= 1.9.1, < 2.7.2

affected

>= d8c3db4e5935476e496d979fb01f775d3d3282e6, < f229cab099c69006e25d4bad3579954e481dc566

affected

References

github.com/...erNeue/security/advisories/GHSA-4x6x-8rm8-c37j

github.com/...ommit/d8c3db4e5935476e496d979fb01f775d3d3282e6

github.com/...ommit/f229cab099c69006e25d4bad3579954e481dc566

cve.org (CVE-2025-21612)

nvd.nist.gov (CVE-2025-21612)

Download JSON

https://cve.threatint.com/CVE/CVE-2025-21612

Support options

Helpdesk Chat, Email, Knowledgebase

Subscribe to our newsletter to learn more about our work.