EUVD-2026-110800

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the openerlink parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The...

PT-2026-126370

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. Th...

REDAXO CMS core cross-site scripting vulnerability

REDAXO CMS core versions prior to 5.21.3 contain a cross-site scripting vulnerability. This flaw arises because the openerlink parameter on the backend media pool details page is not HTML-escaped, making it susceptible to reflected XSS attacks. Unauthenticated attackers can trick logged-in backen...