PT-2026-146517
CVE-2026-128028
·
تاريخ النشر
2026-11-13
·
تاريخ التحديث
2026-11-13
الوصف من
CVSS 3.1
4.7
متوسطةالمقاييسAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting vulnerability in Mage Catalog Model Product Option Type File, which accepts guest SVG, XHTML, or XML uploads through product File custom options with an empty allowed-extension list. Unauthenticated attackers can send the file URL under media/custom options/ to victims, executing script in the store origin and exposing administrator sessions when the admin panel shares that origin.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾