6.1
MediumCVSS 3.1 · from VulnCheck
CVE-2026-117535
REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
core · Cross-site scripting · CWE-79Affectedcore
FixUpdate to 5.21.3 or newer
PublishedOct 27, 10:59 · VulnCheck
ScoredOct 27 · 6.1 · VulnCheck
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:10 UTC
What we know
No known exploitation. CISA KEV, checked 22:10 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
Description
REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim's permissions, including code execution via template or module edits when the victim is an administrator.
From VulnCheck
Affected and fixed versions
ProductAffectedFixed incorebefore 5.21.35.21.3coreNot affected5.21.3
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known