CVE-2025-21612

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

TabberNeue is a MediaWiki extension that allows the wiki to create tabs. Prior to 2.7.2, TabberTransclude.php doesn't escape the user-supplied page name when outputting, so an XSS payload as the page name can be used here. This vulnerability is fixed in 2.7.2.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Weakness enumeration

CWE-79 CWE-80

Affected software

Vendor	Product	Versions
StarCitizenTools	mediawiki-extensions-TabberNeue	>= 1.9.1, < 2.7.2; >= d8c3db4e5935476e496d979fb01f775d3d3282e6, < f229cab099c69006e25d4bad3579954e481dc566

References

Timeline

Published: Jan 6, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-216139.8go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git ve CVE-2025-216147.5go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-gi CVE-2025-216155.5AAT (Another Activity Tracker) is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than CVE-2025-216165.4Plane is an open-source project management tool. A cross-site scripting (XSS) vulnerability has been identified in Plane versions prior to 0 CVE-2025-216176.3Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a crypto CVE-2025-216187.5NiceGUI is an easy-to-use, Python-based UI framework. Prior to 2.9.1, authenticating with NiceGUI logged in the user for all browsers, inclu CVE-2025-216199.8GLPI is a free asset and IT management software package. An administrator user can perfom a SQL injection through the rules configuration fo CVE-2025-21624.8The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege us CVE-2025-216207.5Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. When you send a request with the Authorization header to one CVE-2025-216216.1GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.25.0, a reflected cross-site scri CVE-2025-216229.1ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change th CVE-2025-216237.5ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change th