https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 10:37:12 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-247313 EUVD-2026-247313 https://cve.radiocsirt.org/vuln/euvd-2026-247313 https://cve.radiocsirt.org/vuln/fkie_cve-2025-53625 <p>The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. The vulnerability is fixed in 3.6.4.</p> <p>The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. Several #dpl parameters can leak usernames that have been hidden using revision deletion, suppression, or the hideuser block flag. The vulnerability is fixed in 3.6.4.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-53625 https://cve.radiocsirt.org/vuln/ghsa-7pgw-q3qp-6pgq <p><strong>Affected:</strong> Packagist: universal-omega/dynamic-page-list3</p> <p>### Summary Several `#dpl` parameters can leak usernames that have been hidden using revision deletion, suppression, or the `hideuser` block flag.</p> <p>### Details The parameters `adduser`, `addauthor`, and `addlasteditor` output the page creator or last editor using the `%USER%` placeholder. These display the actual username, even when that name has been hidden using revision deletion, suppression (oversight), or `hideuser`.</p> <p>The `%CONTRIBUTOR%` placeholder, used with `addcontribution`, behaves similarly and also reveals hidden usernames.</p> <p>In addition, the following parameters can expose suppressed usernames when combined with `%USER%` or similar output placeholders: - `lastrevisionbefore` - `allrevisionsbefore` - `firstrevisionsince` - `allrevisionssince`</p> <p>These parameters reference specific revisions and allow output of user-related metadata. If a username has been hidden from those revisions, it may still appear in the output.</p> <p>Further, the parameters `createdby`, `notcreatedby`, `modifiedby`, `notmodifiedby`, `lastmodifiedby`, and `notlastmodifiedby` accept usernames as input. When the correct (suppressed) username is used, the query may return matching pages or edits. This can reveal the presence and association of a hidden identity, even if not displayed directly. However, this is a more indirect exposure than the output parameters mentioned above.</p> <p>### Proof of Concept</p> <p>1. Create a page while logged in as a user. 2. Revision delete or suppress the username from the page…</p> <p><strong>Affected:</strong> Packagist: universal-omega/dynamic-page-list3</p> <p>### Summary Several `#dpl` parameters can leak usernames that have been hidden using revision deletion, suppression, or the `hideuser` block flag.</p> <p>### Details The parameters `adduser`, `addauthor`, and `addlasteditor` output the page creator or last editor using the `%USER%` placeholder. These display the actual username, even when that name has been hidden using revision deletion, suppression (oversight), or `hideuser`.</p> <p>The `%CONTRIBUTOR%` placeholder, used with `addcontribution`, behaves similarly and also reveals hidden usernames.</p> <p>In addition, the following parameters can expose suppressed usernames when combined with `%USER%` or similar output placeholders: - `lastrevisionbefore` - `allrevisionsbefore` - `firstrevisionsince` - `allrevisionssince`</p> <p>These parameters reference specific revisions and allow output of user-related metadata. If a username has been hidden from those revisions, it may still appear in the output.</p> <p>Further, the parameters `createdby`, `notcreatedby`, `modifiedby`, `notmodifiedby`, `lastmodifiedby`, and `notlastmodifiedby` accept usernames as input. When the correct (suppressed) username is used, the query may return matching pages or edits. This can reveal the presence and association of a hidden identity, even if not displayed directly. However, this is a more indirect exposure than the output parameters mentioned above.</p> <p>### Proof of Concept</p> <p>1. Create a page while logged in as a user. 2. Revision delete or suppress the username from the page…</p> https://cve.radiocsirt.org/vuln/ghsa-7pgw-q3qp-6pgq https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2341 <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um beliebigen Code oder SQL-Befehle auszuführen, Cross-Site-Scripting-Angriffe durchzuführen und vertrauliche Informationen offenzulegen.</p> <p>Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um beliebigen Code oder SQL-Befehle auszuführen, Cross-Site-Scripting-Angriffe durchzuführen und vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2341