PT-2026-146535

CVE-2026-128053

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 3.1

4.7

Medium

MetricsAV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting vulnerability in its error pages, which print SCRIPT NAME-derived URLs built by errors/processor.php without escaping. Unauthenticated attackers can craft links that trigger uncaught exceptions on servers deriving SCRIPT NAME from the request path, executing script in the storefront origin within victims' browsers.

Exploitability

Fix

Impacts

Researchers

0Xelkot

Colinmollenhour

Justlife4X4

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers