Skip to content
OpenAdvisories
High · 7.5 CVE-2026-102796 EUVD-2026-89094GHSA-w42g-3487-f7gc

Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters

Published Sep 29, 2026 · Updated Oct 1, 2026 · Assigned by wikimedia-foundation

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection.

This issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.

Affected products

VendorProductAffectedFixed
Wikimedia Foundation Mediawiki - UserPageViewTracker Extension < 1.46.1, 1.45.5, 1.43.10 1.46.1, 1.45.5, 1.43.10

References