PT-2026-126372

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo default fields create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex view::message renders...