[HIGH] Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

PKSA-8k3f-637m-ptt7 GHSA-jr78-w6w5-m8f8

Affected version: >=3.0.0,<=7.2.1

Reported by:
GitHub

[MEDIUM] Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

PKSA-rt5h-3dwq-vdnx GHSA-9rcc-pmj8-ffhr

Affected version: >=4.2.0,<=7.2.0

Reported by:
GitHub

[MEDIUM] Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token

PKSA-yxd8-n1ty-bgkg CVE-2026-77616 GHSA-cx86-7xwp-w9wf

Affected version: >=7.0.0,<=7.1.0

Reported by:
GitHub

[MEDIUM] Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

PKSA-5kcn-7vbr-1pdw CVE-2026-77610 GHSA-q5fm-9mx6-44f4

Affected version: <=7.1.0

Reported by:
GitHub

[MEDIUM] Semantic MediaWiki has an open redirect in Special:URIResolver

PKSA-k3v8-z9j2-2f38 CVE-2026-77609 GHSA-hw3m-8j5x-94ff

Affected version: <=7.1.0

Reported by:
GitHub

[MEDIUM] Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS

PKSA-stqx-crkb-215f CVE-2026-77607 GHSA-7xv3-gf2g-498h

Affected version: <=7.1.0

Reported by:
GitHub

[MEDIUM] Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

PKSA-2trz-n7bz-xg2h CVE-2026-77608 GHSA-59xw-qv23-j3rc

Affected version: <=7.1.0

Reported by:
GitHub

[MEDIUM] Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

PKSA-6xyn-p8dg-1kgj CVE-2026-77606 GHSA-3jp5-3h47-28qf

Affected version: <=7.1.0

Reported by:
GitHub