Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:composer/mediawiki/core@1.22.0
purl pkg:composer/mediawiki/core@1.22.0
Tags Ghost
Next non-vulnerable version 1.35.12
Latest non-vulnerable version 1.40.1
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-a1vt-rm2f-bufa
Aliases:
CVE-2014-2853
GHSA-6h86-9r5g-f2h5
Cross-site scripting vulnerability in includes/actions/InfoAction.php Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
1.22.6
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-04T14:31:38.424418+00:00 GHSA Importer Affected by VCID-a1vt-rm2f-bufa https://github.com/advisories/GHSA-6h86-9r5g-f2h5 38.1.0
2026-04-03T21:25:57.582260+00:00 GitLab Importer Affected by VCID-a1vt-rm2f-bufa https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/mediawiki/core/CVE-2014-2853.yml 38.1.0