Unscored severity · published Sep 1, 2015
CVE-2015-6737
Cross-site scripting (XSS) vulnerability in the Widgets extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors involving base64 encoded…
–
CVSS
2%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Widgets extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors involving base64 encoded content.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.0% · higher than 81% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Widgets · Widgets Project
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-6737
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-6737
lists.fedoraproject.org
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165193.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/08/12/6
www.openwall.com
http://www.openwall.com/lists/oss-security/2015/08/27/6
www.securityfocus.com
http://www.securityfocus.com/bid/76858
Vendor Advisory
https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-August/000179.html
security.gentoo.org
https://security.gentoo.org/glsa/201510-05
More from Widgets
5.4
CVE-2020-9382
An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki