Mediawiki - Cargo Extension — Vulnerabilities & Security Advisories 13

All 13 CVE vulnerabilities found in Mediawiki - Cargo Extension, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-96878	Cargo Exhibit field alias allows stored XSS CWE-79	6.9	Medium	2026-09-25
CVE-2026-96877	Reflected XSS through Cargo Drilldown full-text search CWE-79	6.9	Medium	2026-09-25
CVE-2026-96876	Anonymous reflected XSS in CargoExport invalid-alias errors CWE-79	6.9	Medium	2026-09-25
CVE-2026-96875	Reflected XSS in Cargo Drilldown hierarchy filters CWE-79	6.9	Medium	2026-09-25
CVE-2026-96874	Stored XSS in Cargo Drilldown tab names CWE-79	2.3	Low	2026-09-25
CVE-2026-14363	Cargo Extension: SQLi in Special:Drilldown CWE-89	-	-	2026-07-01
CVE-2026-58521	SQLi in Cargo extension via year range filter CWE-89	-	-	2026-07-01
CVE-2026-58519	Stored XSS through Cargo's map format CWE-79	-	-	2026-07-01
CVE-2026-39837	Stored XSS through the dynamic table format in Cargo CWE-80	6.1^AI	Medium ^AI	2026-04-07
CVE-2026-39841	Stored XSS through list fields on Cargo's page values and Special:CargoTables CWE-80	6.1^AI	Medium ^AI	2026-04-07
CVE-2026-39840	CSS injection in multiple Cargo display formats CWE-79	6.1^AI	Medium ^AI	2026-04-07
CVE-2026-39839	Stored XSS through URLs in Cargo's map format CWE-80	6.1^AI	Medium ^AI	2026-04-07
CVE-2025-62671	Stored XSS through wikitext in Cargo CWE-79	6.1^AI	Medium ^AI	2025-10-18

All 13 known CVE vulnerabilities affecting Mediawiki - Cargo Extension with full Chinese analysis, references, and POCs where available.