PT-2026-126365

CVE-2026-116900

·

Published

2026-10-27

·

Updated

2026-10-27

Description by

CVSS 3.1
5.4
Medium
MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX INPUT MEDIA or REX INPUT LINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-116900
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com