CVE-2026-117538Medium· 4.1▾ SunlitREDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authentica…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.
core < 5.21.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117533Medium· 4.4REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
CVE-2026-117537Medium· 4.1REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter
CVE-2026-117535Medium· 6.1REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
CVE-2026-116900Medium· 5.4REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets
CVE-2026-58391Medium· 5.4OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58390High· 8.0OPNsense is a FreeBSD based firewall and routing platform