Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2026-14363: SQL Injection in Wikimedia Mediawiki Cargo Extension
CVE-2026-14363
Summary
The Wikimedia Mediawiki Cargo Extension is vulnerable to SQL injection attacks, which could allow unauthorized access to sensitive data. This affects versions of the extension prior to 1.43.9, 1.44.6, and 1.45.4. To protect your system, update the extension to a fixed version.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| mediawiki | cargo |
< 3.9.1 cpe:2.3:a:mediawiki:cargo:*:*:*:*:*:mediawiki:*:* |
Original title
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.
This issue affects ...
Original description
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection.
This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.
nvd CVSS4.0
6.9
Vulnerability type
CWE-89
SQL Injection
Published: 1 Jul 2026 · Updated: 20 Jul 2026 · First seen: 1 Jul 2026