3 matches found
GHSA-MF2P-WJP4-99PQ REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
Summary A stored cross-site scripting XSS vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type's name field without HTML escaping. An attacker with...
CVE-2025-61417: Improper Neutralization of Input During Web Page Generation
Cross-Site Scripting XSS vulnerability exists in TastyIgniter 3.7.7, affecting the /admin/mediamanager component. Attackers can upload a malicious SVG file containing JavaScript code. When an administrator previews the file, the code executes in their browser context, allowing the attacker to...
