PT-2026-126368
CVE-2026-117533
·
تاريخ النشر
2026-10-27
·
تاريخ التحديث
2026-10-27
الوصف من
CVSS 3.1
4.4
متوسطةالمقاييسAV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex media service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾