p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in starcitizentools/citizen-skin

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für starcitizentools/citizen-skin: 0. Davon im KEV-Katalog: 0.

RSS ↗ JSON ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 9

  1. CVE-2025-62508

    Mittel · CVSS 6.5EPSS 0,45%Korrektur verfügbar

    Citizen vulnerable to stored XSS in sticky header button messages

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Citizen from 3.3.0 to 3.9.0 are vulnerable to stored cross-site scripting in the sticky header button message handling. In stickyHeader.js the copyButtonAttributes function assigns innerHTML from a source element’s textContent when copying button labels. This causes escaped HTML in system message content (such as citizen-share, citizen-view-history, citizen-view-edit, and nstab-talk) to be interpreted as HTML in the sticky header, allowing injection of arbitrary script by a user with the ability to edit interface messages. The vulnerability allows a user with t

    starcitizentools/citizen-skinPHP
    • Auf 3.9.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2025-53370

    Hoch · CVSS 8.6EPSS 0,38%Korrektur verfügbar

    Citizen stored XSS vulnerability through short descriptions

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDescription extension are inserted as raw HTML by the Citizen skin, allowing any user to insert arbitrary HTML into the DOM by editing a page. This issue has been patched in version 3.4.0.

    starcitizentools/citizen-skinPHP
    • Auf 3.4.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2025-53368

    Hoch · CVSS 8.6EPSS 0,34%Korrektur verfügbar

    Citizen is vulnerable to stored XSS attack in the legacy search bar

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw HTML without proper sanitization by the Citizen skin when using the old search bar. Any user with page editing privileges can insert cross-site scripting (XSS) payloads into the DOM for other users who are searching for specific pages. This issue has been patched in version 3.4.0.

    starcitizentools/citizen-skinPHP
    • Auf 3.4.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2025-49576

    Mittel · CVSS 6.5EPSS 0,43%Korrektur verfügbar

    Citizen allows stored XSS in search no result messages

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.

    starcitizentools/citizen-skinPHP
    • Auf 3.3.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2025-49578

    Mittel · CVSS 6.5EPSS 0,43%Korrektur verfügbar

    Citizen allows stored XSS in user registration date message

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.

    starcitizentools/citizen-skinPHP
    • Auf 3.3.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2025-49579

    Mittel · CVSS 6.5EPSS 0,41%Korrektur verfügbar

    Citizen allows stored XSS in menu heading message

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.

    starcitizentools/citizen-skinPHP
    • Auf 3.3.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2025-49575

    Mittel · CVSS 6.5EPSS 0,43%Korrektur verfügbar

    Citizen allows stored XSS in Command Palette tip messages

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.

    starcitizentools/citizen-skinPHP
    • Auf 3.3.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2025-49577

    Mittel · CVSS 6.5EPSS 0,43%Korrektur verfügbar

    Citizen allows stored XSS in preference menu headings

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This vulnerability is fixed in 3.3.1.

    starcitizentools/citizen-skinPHP
    • Auf 3.3.1 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2024-47536

    Mittel · CVSS 4.8EPSS 0,46%Korrektur verfügbar

    starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field

    Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0.

    starcitizentools/citizen-skinPHP
    • Auf 2.31.0 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →