{"action":"Upgrade mediawiki to 1:1.31.2-1 or later.","affected":[{"fixed":"1:1.31.2-1","introduced":"0"}],"component":"mediawiki","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:14","exploited":false,"fixed_versions":["1:1.31.2-1"],"id":"tcs_01M5NDRA11MVRK1PP33GFGA3KV","modified_at":"2026-09-21T07:00:56.538278649Z","published_at":"2019-07-10T16:15:11.150Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2019-12471","https://security-tracker.debian.org/tracker/CVE-2019-12471"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2019-12471#Debian:14/mediawiki","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2019-12471"}],"summary":"Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32."}