CVE-2026-14363

Description

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This issue affects Mediawiki - Cargo Extension: from * before 1.43.9,1.44.6,1.45.4.

References

• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1269701
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1279498
• https://phabricator.wikimedia.org/T422774
• https://phabricator.wikimedia.org/T422774