CVE-2026-116900Medium· 5.4▾ SunlitREDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_IN…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts.
core < 5.21.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117533Medium· 4.4REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
CVE-2026-117537Medium· 4.1REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter
CVE-2026-117538Medium· 4.1REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter
CVE-2026-117535Medium· 6.1REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
CVE-2026-58391Medium· 5.4OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58390High· 8.0OPNsense is a FreeBSD based firewall and routing platform