Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

FeedsContactPrivacy© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-103437 — Local proof-of-concept and sanitized report for CVE-2026-103437, a canonical URL XSS in MediaWiki ReadingLists triggered via crafted import links. | Kitploit
Tools/GitHubGitHub/bombobombone/cve-2026-103437
Vulnerability AnalysisExploitationWeb Application ExploitationWeb Security
GitHubbombobombone/cve-2026-103437

CVE-2026-103437

Local proof-of-concept and sanitized report for CVE-2026-103437, a canonical URL XSS in MediaWiki ReadingLists triggered via crafted import links.

View Repository
2427 days agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-103437: ReadingLists imported canonical URL XSS

Reporter: Marco Paciaroni (BomboBombone).

ReadingLists accepted an imported project URL and used the response's canonicalurl as a card link without checking its scheme. A signed-in visitor who opened a crafted import link and clicked the card could run JavaScript in the wiki origin.

Proof of concept

The script starts a loopback-only project API fixture and prints an import URL for a local MediaWiki installation with ReadingLists enabled. Open that URL while signed in to the local wiki, then click the imported card. The harmless marker changes the browser tab title.

python poc.py --wiki-url http://127.0.0.1:4002 --port 45813

Use only an isolated local wiki. The script accepts loopback wiki URLs only.

References

  • CVE record
  • Public Phabricator report
  • Blog write-up
Download Tool