Skip to content
OpenAdvisories

Product · miraheze

ImportDump

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.4
    CVE-2024-47816

    Users can impersonate import requesters if their actor IDs coincide in ImportDump

    ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests. Therefore, if a user on another wiki happens to have the same actor ID as someone on the central w…

    miraheze ImportDump
  • Medium 6.0
    CVE-2024-47812

    Cross-site Scripting (XSS) on Special:RequestImportQueue when displaying request date in ImportDump

    ImportDump is an extension for mediawiki designed to automate user import requests. Anyone who can edit the interface strings of a wiki (typically administrators and interface admins) can embed XSS payloads in the messages for dates, and thus XSS anyone who v…

    miraheze ImportDump