PT-2026-146535
CVE-2026-128053
·
تاريخ النشر
2026-11-13
·
تاريخ التحديث
2026-11-13
الوصف من
CVSS 3.1
4.7
متوسطةالمقاييسAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT NAME from the request path, executing script in the storefront origin within victims' browsers.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾