{"id":"CVE-2026-102796","aliases":["EUVD-2026-89094","GHSA-w42g-3487-f7gc"],"status":"published","title":"Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection.\n\nThis issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00312,"percentile":0.24292,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-89"],"published":"2026-09-29T16:55:37Z","modified":"2026-10-01T21:32:46Z","products":[{"vendor":"wikimedia foundation","product":"mediawiki - userpageviewtracker extension"}],"references":[{"url":"https://phabricator.wikimedia.org/T432836","tags":["exploit"]},{"url":"https://gerrit.wikimedia.org/r/q/I43c5360c2f78611351b5dc4c90a80e627d51deaf"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102796"},{"url":"https://github.com/advisories/GHSA-w42g-3487-f7gc"}],"sources":{"cve":[{"id":"CVE-2026-102796","title":"Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection.\n\nThis issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.","status":"published","published":"2026-09-29T16:55:37.825Z","modified":"2026-10-01T18:16:55.951Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T13:38:54.394896Z"}],"euvd":[{"id":"EUVD-2026-89094","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection.\n\nThis issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.","status":"published","published":"2026-09-29T16:55:37Z","modified":"2026-10-01T18:16:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:44.322377Z"}],"ghsa":[{"id":"GHSA-w42g-3487-f7gc","title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection.\n\nThis issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.","status":"published","published":"2026-09-29T18:31:51Z","modified":"2026-10-01T21:32:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:12:41.196374Z"}],"nvd":[{"id":"CVE-2026-102796","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection.\n\nThis issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.","status":"published","published":"2026-09-29T17:17:08.303Z","modified":"2026-10-01T19:17:17.25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:12:52.413234Z"}]}}