https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 28 Oct 2026 22:38:22 +0000 https://db.gcve.eu/vuln/cve-2026-117535 <p><strong>Affected:</strong> redaxo core</p> <p>REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim&#39;s permissions, including code execution via template or module edits when the victim is an administrator.</p> <p><strong>Affected:</strong> redaxo core</p> <p>REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim&#39;s permissions, including code execution via template or module edits when the victim is an administrator.</p> https://db.gcve.eu/vuln/cve-2026-117535