MediaWiki CSS Injection and Local Script Inclusion Vulnerabilities
Description
Two vulnerabilities have been identified in MediaWiki, which could be exploited by attackers to bypass restrictions or gain knowledge of sensitive information.
The first issue is caused by an input validation error when processing CSS comments, which could be exploited by attackers to cause arbitrary code to be executed by the user's browser.
The second vulnerability is caused by an input validation error language files, which could allow attackers to include PHP scripts already present on the web server.
Vulnerable Products
Vulnerable Software: MediaWiki versions prior to 1.16.2
