CVE-2026-117535

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim's permissions, including code execution via template or module edits when the victim is an administrator.

• CWE-79

• https://github.com/redaxo/core/security/advisories/GHSA-5293-gg47-5xmh
• https://www.vulncheck.com/advisories/redaxo-before-5.21.3-reflected-xss-via-opener-link-in-media-pool

Published

Oct 27, 2026

Last Modified

Oct 27, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11752A vulnerability has been identified in armeria-xds versions …5.9
• CVE-2026-117526A vulnerability was found in reduxjs redux-devtools 5.0.0. A…5.3
• CVE-2026-117530In JetBrains Junie CLI before 26.8.17 command execution was …6.7
• CVE-2026-117532REDAXO core from 5.3.0 before 5.21.4 contains an authenticat…9.8
• CVE-2026-117533REDAXO from 5.18.0 before 5.21.4 contains a stored cross-sit…4.4
• CVE-2026-117534REDAXO before 5.21.3 contains a cross-site request forgery v…5.4
• CVE-2026-117536REDAXO before 5.21.3 contains a cross-site request forgery v…8.8
• CVE-2026-117537REDAXO before 5.21.0 contains a reflected cross-site scripti…4.1
• CVE-2026-117538REDAXO before 5.21.0 contains a reflected cross-site scripti…4.1
• CVE-2026-117539darylldoyle svg-sanitizer before 1.0.0 contains CSS injectio…3.5
• CVE-2026-11754Observable discrepancy vulnerability in Seres Software syWEB…5.3
• CVE-2026-117540svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of s…7.5