PT-2025-42677 · Mediawiki · Advancedsearch Extension+1

Somerandomdeveloper · Published 2025-10-18 · Updated 2025-10-20 · CVE-2025-62662

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Mediawiki - AdvancedSearch Extension versions prior to 1.39

Description A flaw exists in the Mediawiki - AdvancedSearch Extension that allows for Stored Cross-site Scripting (XSS). This issue is due to improper neutralization of input during web page generation. The vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users.

Recommendations Update the Mediawiki - AdvancedSearch Extension to version 1.39 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62662

Affected Products

Advancedsearch Extension

Mediawiki

References · 6

• 🔥 https://phabricator.wikimedia.org/T402146 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-62662 · Security Note
• https://t.me/cveNotify/139312 · Telegram Post
• https://gerrit.wikimedia.org/r/q/I91bba2b570643ef74e6c210e7250e05cd2aa388e · Note
• https://twitter.com/CVEnew/status/1979406113708679401 · Twitter Post
• https://t.me/cveNotify/139460 · Telegram Post