Rezultati pretraživanja za 'Od datuma: 01.11.2024.'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-116900 | 5.4 | REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or | 2026-10-27 15:02:47 | 2026-10-27 11:17:33 |
| CVE-2026-116899 | 6.5 | REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit | 2026-10-27 15:02:47 | 2026-10-27 11:17:32 |
| CVE-2026-116897 | 6.5 | REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holdi | 2026-10-27 15:02:47 | 2026-10-27 11:17:32 |
| CVE-2026-116896 | 7.5 | REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' | 2026-10-27 15:02:47 | 2026-10-27 11:17:32 |
| CVE-2026-116895 | 5.4 | REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link t | 2026-10-27 15:02:47 | 2026-10-27 11:17:32 |
| CVE-2026-116893 | 6.8 | REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active | 2026-10-27 15:02:47 | 2026-10-27 11:17:32 |
| CVE-2026-117494 | - | Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing | 2026-10-27 15:02:47 | 2026-10-27 10:16:54 |
| CVE-2026-117493 | - | Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the ‘desc’ and ‘text’ parameters. The code entered is executed in the browser when the widget is rendered, which could | 2026-10-27 15:02:47 | 2026-10-27 10:16:54 |
| CVE-2026-16307 | 4.3 | Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7. | 2026-10-27 15:00:49 | 2026-10-27 14:17:00 |
| CVE-2026-118027 | - | Frame poisoning in the Layout component. This vulnerability was fixed in Firefox ESR 115.44. | 2026-10-27 15:00:49 | 2026-10-27 14:17:00 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/13482
Zapisa po stranici: