{"id":"CVE-2026-102796","revision":"3d37f0050a894db68dec3bb1f50ad6ae","records":[{"revision":"3d37f0050a894db68dec3bb1f50ad6ae","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-102796","aliases":[],"title":"Unauthenticated SQL injection in UserPageViewTracker via filterusers and ignoreusers parameters","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wikimedia Foundation Mediawiki - UserPageViewTracker Extension allows SQL Injection.\n\nThis issue affects Mediawiki - UserPageViewTracker Extension: from * before 1.46.1, 1.45.5, 1.43.10.","state":0,"publishedAt":"2026-09-29T16:55:37.825+00:00","modifiedAt":"2026-10-01T18:16:55.951+00:00","affected":[{"ecosystem":"Vendor product","name":"Mediawiki - UserPageViewTracker Extension","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Wikimedia Foundation\",\n                    \"product\": \"Mediawiki - UserPageViewTracker Extension\",\n                    \"repo\": \"https://gerrit.wikimedia.org/g/mediawiki/extensions/UserPageViewTracker/+/refs/heads/master\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"*\",\n                            \"lessThan\": \"1.46.1, 1.45.5, 1.43.10\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://phabricator.wikimedia.org/T432836","https://gerrit.wikimedia.org/r/q/I43c5360c2f78611351b5dc4c90a80e627d51deaf"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102796","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-102796","identifiers":["CVE-2026-102796"]},"retained":false,"historicalAffected":[]}],"coverage":[]}