https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-19T17:11:57.820208+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2020-15179 CVE-2020-15179 — HTML Injection in ScratchSig 2026-10-19T17:11:57.823366+00:00

Affected: InternationalScratchWiki wiki-scratchsig

The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using <script> tag inside <scratchsig> tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.