CVE-2026-14363
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
An SQL injection vulnerability in the Cargo extension for MediaWiki allows an attacker to inject malicious SQL code. The issue affects versions before 1.43.9, 1.44.6, and 1.45.4.
Risk Assessment
An attacker can gain unauthorized access to the database, steal or modify data, posing a serious threat to information confidentiality and integrity.
Recommendation
Immediately update the Cargo extension to version 1.43.9, 1.44.6, or 1.45.4, depending on the MediaWiki branch in use.
Other vulnerabilities in MediaWiki Cargo Extension
See all- CVE-2026-58521Critical
A SQL injection vulnerability was found in the Cargo extension for MediaWiki due to improper neutralization of special elements in SQL commands. The issue affects versions before 1.43.9, 1.44.6, and 1.45.4.
- CVE-2026-96878Medium
Reflected XSS vulnerability in Mediawiki Cargo extension due to improper input neutralization during web page generation. Affects versions through 3.9.4.
- CVE-2026-96877Medium
Reflected XSS vulnerability in Mediawiki Cargo extension due to improper input neutralization during web page generation. Affects versions through 3.9.4.
- CVE-2026-96876Medium
Reflected XSS vulnerability in Mediawiki Cargo extension due to improper input neutralization during web page generation. Affects versions through 3.9.4.
- CVE-2026-96875Medium
Stored XSS vulnerability in Mediawiki Cargo extension due to improper input neutralization during web page generation. Affects versions through 3.9.4.
- CVE-2026-96874Low
The Mediawiki - Cargo extension through version 3.9.4 contains a Stored XSS vulnerability due to improper input neutralization during web page generation.
- CVE-2026-58519Medium
A stored cross-site scripting (XSS) vulnerability has been found in the Cargo extension for MediaWiki. The flaw is caused by improper input neutralization during web page generation. All versions before 3.9.1 are affected.
- CVE-2026-39841Medium
Stored XSS vulnerability in the Cargo extension for MediaWiki. Improper neutralization of script-related HTML tags allows an attacker to inject malicious JavaScript code that executes whenever the page is viewed.
- CVE-2026-39840Medium
XSS vulnerability in the Cargo extension for MediaWiki, targeting non-script elements. Improper input neutralization during page generation allows injection of malicious code.
- CVE-2026-39839Medium
The Cargo extension for MediaWiki before version 3.8.7 is vulnerable to stored XSS due to improper neutralization of script-related HTML tags. Attackers can inject malicious scripts that execute when a page is viewed.
Original NVD description (English source)
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS