EUVD-2026-110796

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REXINPUTMEDIA or REXINPUTLINK values that break out of the value...