CVE-2026-117537

REDAXO versions before 5.21.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the metainfo_default_fields_create API , where the type parameter is rendered unescaped by the rex_view::message() function. An authenticated attacker can craft a malicious lin...

CVE-2026-117537 REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfodefaultfieldscreate API. Attackers can craft a link with a valid CSRF token and HTML payload that rexview::message renders...

EUVD-2026-110802

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfodefaultfieldscreate API. Attackers can craft a link with a valid CSRF token and HTML payload that rexview::message renders...