PT-2025-28015 · Mediawiki+1 · Mediawiki+1

Published 2025-07-04 · Updated 2025-07-04 · CVE-2025-53482

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Mediawiki - IPInfo Extension versions 1.39.X through 1.39.12 Mediawiki - IPInfo Extension versions 1.42.X through 1.42.6 Mediawiki - IPInfo Extension versions 1.43.X through 1.43.1

Description: The issue affects the Mediawiki - IPInfo Extension, allowing Cross-Site Scripting (XSS). This is due to an Improper Neutralization of Input During Web Page Generation vulnerability.

Recommendations: For versions 1.39.X through 1.39.12, update to version 1.39.13 or later. For versions 1.42.X through 1.42.6, update to version 1.42.7 or later. For versions 1.43.X through 1.43.1, update to version 1.43.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-53482

Affected Products

Ipinfo Extension

Mediawiki

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-53482 · Security Note
• https://twitter.com/CVEnew/status/1941177192936886408 · Twitter Post
• https://phabricator.wikimedia.org/T394393 · Note
• https://t.me/cvenotify/127728 · Telegram Post
• https://gerrit.wikimedia.org/r/q/I66221bae94cf222531a7dc5622b2d43e01f7f8eb · Note