CVE-2020-10960

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.wikimedia.org/pipermail/wikitech-l/2020-March/093243.htmlMailing List, Patch, Vendor Advisory
https://phabricator.wikimedia.org/T246602Exploit, Vendor Advisory
https://lists.wikimedia.org/pipermail/wikitech-l/2020-March/093243.htmlMailing List, Patch, Vendor Advisory
https://phabricator.wikimedia.org/T246602Exploit, Vendor Advisory

Timeline

Published: Apr 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-109627.8In PowerShell App Deployment Toolkit (aka PSAppDeployToolkit) through 3.8.0, an incorrect access control vulnerability in the default config CVE-2020-109637.2FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_imag CVE-2020-109649.8Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a CVE-2020-109658.1Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated password resets via login/resetadminpassword of the d CVE-2020-109666.5In the Password Reset Module in VESTA Control Panel through 0.9.8-25 and Hestia Control Panel before 1.1.1, Host header manipulation leads t CVE-2020-109675.3In Dovecot before 2.3.10.1, remote unauthenticated attackers can crash the lmtp or submission process by sending mail with an empty localpar CVE-2020-109688.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.CVE-2020-109698.8FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.J CVE-2020-10976.5<p>An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacke CVE-2020-109718.8An issue was discovered on Wavlink Jetstream devices where a crafted POST request can be sent to adm.cgi that will result in the execution o CVE-2020-109727.5An issue was discovered where a page is exposed that has the current administrator password in cleartext in the source code of the page. No CVE-2020-109737.5An issue was discovered in Wavlink WN530HG4, Wavlink WN531G3, Wavlink WN533A8, and Wavlink WN551K1 affecting /cgi-bin/ExportAllSettings.sh w