EUVD-2026-125945

A vulnerability was found in sergix44 XBackBone up to 3.8.2. Impacted is the function MediaController::getRawById of the file app/Controllers/MediaController.php. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made public and...

CVE-2026-129267

The sergix44 XBackBone software, version 3.8.2 and below , is vulnerable to a cross-site scripting (XSS) flaw in the MediaController::getRawById function within app/Controllers/MediaController.php. This vulnerability allows for remote attacks through input manipulation. While a public exploit exi...