PT-2026-33973 · Mediawiki · Semantic Mediawiki

Published 2026-04-21 · Updated 2026-04-21 · CVE-2025-10354

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Semantic MediaWiki (affected versions not specified)

Description A reflected Cross-Site Scripting (XSS) issue exists where an attacker can execute JavaScript code in a victim's browser. This is achieved by sending a malicious URL targeting the '/index.php/Speciaal:GefacetteerdZoeken' endpoint. Exploitation may lead to the theft of sensitive user data, such as session cookies, or allow actions to be performed on behalf of the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-10354

Affected Products

Semantic Mediawiki

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-10354 · Security Note
• https://incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-semantic-mediawiki · Patch
• https://twitter.com/incibe_cert/status/2046531333610995815 · Twitter Post
• https://twitter.com/CVEnew/status/2046620101277818924 · Twitter Post