Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:alpm/archlinux/mediawiki@1.28.2-1
purl pkg:alpm/archlinux/mediawiki@1.28.2-1
Next non-vulnerable version 1.28.3-1
Latest non-vulnerable version 1.38.3-1
Risk 10.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-ks7b-f17t-dfd4
Aliases:
CVE-2017-9841
GHSA-r7c9-c69m-rph8
Code Injection in PHPUnit Util/PHP/eval-stdin.php in PHPUnit starting with 4.8.19 and before 4.8.28, as well as 5.x before 5.6.3, allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a `<?php ` substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php URI.
1.28.3-1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-9e5y-vgvx-73d6 Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities. CVE-2017-0372

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T18:27:11.960660+00:00 Arch Linux Importer Fixing VCID-9e5y-vgvx-73d6 https://security.archlinux.org/AVG-259 38.0.0
2026-04-01T18:24:40.754421+00:00 Arch Linux Importer Affected by VCID-ks7b-f17t-dfd4 https://security.archlinux.org/AVG-491 38.0.0