CVE-2026-58521

Critical · CVSS 9.8

Wikimedia Foundation MediaWiki Cargo Extension — SQL Injection (CWE-89)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-89

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

Search profile — drives PoC discovery

Symbols Cargocargoquerycargo_tablescargo_fieldsCargoSQLQueryCargoQueryCargoDrilldownUtilsCargoUtilssqlQuerywherejoin_onfieldstables

Keywords CVE-2026-58521MediaWiki Cargo SQL injectionCargo extension SQLiMediaWiki Cargo Extension vulnerabilityT428274gerrit 1298854MediaWiki Cargo before 1.43.9MediaWiki Cargo before 1.44.6MediaWiki Cargo before 1.45.4Cargo extension PoC

Versions: * before 1.43.9, 1.44.6, 1.45.4

References

Status: enriched · ingested 2026-07-07T00:00:32.000Z · profiled 2026-07-07T00:30:32.000Z