[HIGH] Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks

PKSA-8k3f-637m-ptt7 GHSA-jr78-w6w5-m8f8

Affected version: >=3.0.0,<=7.2.1

Reported by:
GitHub

[MEDIUM] Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)

PKSA-rt5h-3dwq-vdnx GHSA-9rcc-pmj8-ffhr

Affected version: >=4.2.0,<=7.2.0

Reported by:
GitHub