CVE-2026-117537 REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfodefaultfieldscreate API. Attackers can craft a link with a valid CSRF token and HTML payload that rexview::message renders...

PT-2026-126372

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo default fields create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex view::message renders...

PT-2026-33906

Summary A reflected XSS vulnerability has been identified in the REDAXO backend. The function parameter is concatenated into an API error message and rendered without HTML escaping. --- Details Root cause User input function is injected into an exception message, then rendered by rex view::error...

Cross-Site Scripting (XSS)

clickstorm/cs-seo is vulnerable to cross-site scripting XSS. The vulnerability is due to improper handling of data in the JSON-LD output, allows an attacker to execute arbitrary JavaScript code in the context of the affected TYPO3 backend session...

CVE-2024-55945 Cross-Site Request Forgery in DB Check Module in TYPO3

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

Denial Of Service (DoS)

python-django-horizon is vulnerable to denial of service. Session records are not properly handled when using a db or memcached session engine, allowing remote attackers to make repeated requests to the login page to create excessive backend session entries which would potentially result in a...