https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-28T22:38:25.818665+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-116900 CVE-2026-116900 — REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets 2026-10-28T22:38:25.820187+00:00

Affected: redaxo core

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts.