CVE-2005-2215

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

Cross-site scripting (XSS) vulnerability in MediaWiki before 1.4.x before 1.4.6 and 1.5 before 1.5beta3 allows remote attackers to inject arbitrary web script or HTML via a parameter in the page move template, a different vulnerability than CVE-2005-1888.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://secunia.com/advisories/15950Patch, Vendor Advisory
http://sourceforge.net/project/shownotes.php?release_id=340290Patch
http://www.novell.com/linux/security/advisories/2005_19_sr.html
http://www.securityfocus.com/bid/14181Patch
http://secunia.com/advisories/15950Patch, Vendor Advisory
http://sourceforge.net/project/shownotes.php?release_id=340290Patch
http://www.novell.com/linux/security/advisories/2005_19_sr.html
http://www.securityfocus.com/bid/14181Patch

Timeline

Published: Jul 12, 2005
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2005

CVE-2005-22167.5PHP remote file inclusion vulnerability in gals.php in PhotoGal Photo Gallery 1.5 and earlier allows remote attackers to execute arbitrary c CVE-2005-22175.0Dansie Shopping Cart stores the vars.dat file under the web root with insufficient access control, which might allow remote attackers to obt CVE-2005-22187.2The device file system (devfs) in FreeBSD 5.x does not properly check parameters of the node type when creating a device node, which makes h CVE-2005-22194.6Hosting Controller 6.1 Hotfix 2.1 allows remote authenticated users to perform unauthorized actions, such as modifying the credit limit, via CVE-2005-22205.0Dragonfly Commerce allows remote attackers to change a product price by modifying the x_DragonflyCartProductPrice hidden field to (1) dc_Cat CVE-2005-22217.5Multiple SQL injection vulnerabilities in Dragonfly Commerce allows remote attackers to modify SQL statements and possibly execute arbitrary CVE-2005-222210.0Unknown vulnerability in the HTTPMail service in MailEnable Professional before 1.6 has unknown impact and attack vectors.CVE-2005-22235.0Unknown vulnerability in the SMTP service in MailEnable Standard before 1.9 and Professional before 1.6 allows remote attackers to cause a d CVE-2005-22245.0aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) vi CVE-2005-22255.0Microsoft MSN Messenger allows remote attackers to cause a denial of service via a plaintext message containing the ".pif" string, which is CVE-2005-22265.0Microsoft Outlook Express 6.0 leaks the default news server account when a user responds to a "watched" conversation thread, which could all CVE-2005-22277.2Softiacom wMailserver 1.0 stores passwords in plaintext in the Darsite\MAILSRV\Admin key, which allows local users to gain administrator pri