CVE-2020-15274

Published: Oct 26, 2020Modified: Jun 17, 2026

5.4

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

In Wiki.js before version 2.5.162, an XSS payload can be injected in a page title and executed via the search results. While the title is properly escaped in both the navigation links and the actual page title, it is not the case in the search results. Commit a57d9af34c15adbf460dde6553d964efddf433de fixes this vulnerability (version 2.5.162) by properly escaping the text content displayed in the search results.

Affected (1)

Products: Requarks: Wiki.js

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Requarks Wiki.js	Before 2.5.162

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (6)

https://docs.requarks.io/releases

Source: security-advisories@github.com

Release NotesVendor Advisory

https://github.com/Requarks/wiki/commit/a57d9af34c15adbf460dde6553d964efddf433de

Source: security-advisories@github.com

PatchThird Party Advisory

https://github.com/Requarks/wiki/security/advisories/GHSA-pgjv-84m7-62q7

Source: security-advisories@github.com

PatchThird Party Advisory

https://docs.requarks.io/releases

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

https://github.com/Requarks/wiki/commit/a57d9af34c15adbf460dde6553d964efddf433de

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/Requarks/wiki/security/advisories/GHSA-pgjv-84m7-62q7

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.