CVE-2025-10354CWE-79cross-site-scripting

CVE-2025-10354

published April 21, 2026

CVSS
5.1
EPSS
0%
Percentile
19.9
In the wild
Unconfirmed
What it is

Cross-Site Scripting (XSS) vulnerability reflected in Semantic MediaWiki. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user.

The record
Technical detail
CVSS
5.1 · NONE
CVSS v4.0
Not supplied
EPSS
0.00285 · 19.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-04-21T19:16Z
References (1)
https://www.incibe.es/en/incibe-cert/notices/aviso/reflected-cross-site-scripting-xss-semantic-mediawiki · [email protected]
EPSS history
Timeline
  • 21 APR 14:42Z
    Reflected Cross-Site Scripting (XSS) in Semantic MediaWiki
    cvelistv5