CVE-2020-26120

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even without the element being appended to the DOM.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gerrit.wikimedia.org/r/q/I42e079bc875d17b336ab015f3678eaedc26e10eaVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
https://phabricator.wikimedia.org/T262213Exploit, Issue Tracking, Patch, Vendor Advisory
https://gerrit.wikimedia.org/r/q/I42e079bc875d17b336ab015f3678eaedc26e10eaVendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
https://phabricator.wikimedia.org/T262213Exploit, Issue Tracking, Patch, Vendor Advisory

Timeline

Published: Sep 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-261217.5An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page i CVE-2020-261227.2Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. The Baseboard Managemen CVE-2020-261248.8openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.CVE-2020-261296.5In JetBrains Ktor before 1.4.1, HTTP request smuggling was possible.CVE-2020-26136.0Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Global EM Framework). Supported versi CVE-2020-261307.8Issues were discovered in Open TFTP Server multithreaded 1.66 and Open TFTP Server single port 1.66. Due to insufficient access restrictions CVE-2020-261317.8Issues were discovered in Open DHCP Server (Regular) 1.75 and Open DHCP Server (LDAP Based) 0.1Beta. Due to insufficient access restrictions CVE-2020-261327.8An issue was discovered in Home DNS Server 0.10. Due to insufficient access restrictions in the default installation directory, an attacker CVE-2020-261337.8An issue was discovered in Dual DHCP DNS Server 7.40. Due to insufficient access restrictions in the default installation directory, an atta CVE-2020-261346.1Live Helper Chat before 3.44v allows stored XSS in chat messages with an operator via BBCode.CVE-2020-261356.1Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATH_INFO.CVE-2020-261366.5In SilverStripe through 4.6.0-rc1, GraphQL doesn't honour MFA (multi-factor authentication) when using basic authentication.