Approved changes feed: RSS · Atom
cpe:2.3:a:starcitizen.tools:citizen:*:*:*:*:*:mediawiki:*:*part: a version: * update: *
| Vendor | Starcitizen.Tools (f106f5de-11a1-5dd4-a4ad-ccf55bc57e15) |
|---|---|
| Product | Citizen (3d78b61c-c97e-510e-a009-0745526612a7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | mediawiki |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-53370 |
vulnerable | 2026-06-08 07:31:14.452341 |
Citizen stored XSS vulnerability through short descriptions
HIGH (8.6)
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.
Published: 2025-07-03T19:45:32.163Z
Updated: 2025-07-07T19:01:01.183Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-53368 |
vulnerable | 2026-06-08 07:31:14.450950 |
Citizen is vulnerable to stored XSS attack in the legacy search bar
HIGH (8.6)
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0.
Published: 2025-07-03T19:34:50.057Z
Updated: 2025-07-03T19:50:44.553Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-49579 |
vulnerable | 2026-06-08 07:29:13.892286 |
Citizen allows stored XSS in menu heading message
MEDIUM (6.5)
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.
Published: 2025-06-12T18:50:44.360Z
Updated: 2025-06-12T19:16:43.720Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-49578 |
vulnerable | 2026-06-08 07:29:13.891912 |
Citizen allows stored XSS in user registration date message
MEDIUM (6.5)
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.
Published: 2025-06-12T18:50:49.300Z
Updated: 2025-06-12T19:12:17.575Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-49577 |
vulnerable | 2026-06-08 07:29:13.891396 |
Citizen allows stored XSS in preference menu headings
MEDIUM (6.5)
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.
Published: 2025-06-12T18:45:18.415Z
Updated: 2025-06-12T19:01:58.426Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-49576 |
vulnerable | 2026-06-08 07:29:13.890966 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-49575 |
vulnerable | 2026-06-08 07:29:13.890380 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-47536 |
vulnerable | 2026-06-08 06:48:12.542778 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-36123 |
vulnerable | 2026-06-08 06:39:43.694836 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.