PT-2026-37254

Name of the Vulnerable Software and Affected Versions Magento Long Term Support LTS versions prior to 20.18.0 Description The Mage ProductAlert AddController::stockAction function reads the uenc query parameter and passes it directly to $this- redirectUrl$backUrl without verifying if the URL is...

Cross-site Scripting (XSS)

Overview com.liferay:com.liferay.journal.web is a Liferay Journal Web Affected versions of this package are vulnerable to Cross-site Scripting XSS via the use of journalEditArticleDisplayContext.getBackURL when editing articles. An attacker can execute arbitrary JavaScript code in the context of...