CVE-2026-128053

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPTNAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught...