https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:26:41 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63001 <p>REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator&#39;s browser when that administrator tries to delete media referenced by the type&#39;s effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.</p> <p>REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator&#39;s browser when that administrator tries to delete media referenced by the type&#39;s effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-63001 https://vulnerability.circl.lu/vuln/ghsa-mf2p-wjp4-99pq <p><strong>Affected:</strong> Packagist: redaxo/source</p> <p>### Summary</p> <p>A stored cross-site scripting (XSS) vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type&#39;s `name` field without HTML escaping. An attacker with access to the Media Manager addon can store an XSS payload as a type name; the payload executes in the browser of any administrator who subsequently tries to delete a media file linked to that type&#39;s effects. This can lead to session hijacking and full backend account takeover.</p> <p>---</p> <p>### Details</p> <p>**File:** `redaxo/src/addons/media_manager/lib/media_manager.php` **Function:** `mediaIsInUse()` — registered on the `MEDIA_IS_IN_USE` extension point in `boot.php`</p> <p>When `rex_media_service::deleteMedia()` is called, it invokes `rex_mediapool::mediaIsInUse($filename)`, which fires the `MEDIA_IS_IN_USE` extension point. The media_manager addon&#39;s handler queries all effects whose `parameters` JSON contains the filename, then constructs an HTML anchor with the type name inserted verbatim:</p> <p>```php // media_manager.php ~line 457 ← VULNERABLE $message = &#39;&lt;a href=&#34;javascript:openPage(\&#39;&#39; . rex_url::backendPage(...) . &#39;\&#39;)&#34;&gt;&#39; . rex_i18n::msg(&#39;media_manager&#39;) . &#39; &#39; . rex_i18n::msg(&#39;media_manager_effect_name&#39;) . &#39;: &#39; . (string) $sql-&gt;getValue(&#39;name&#39;) // ← NO rex_escape() call . &#39;&lt;/a&gt;&#39;; ```</p> <p>The returned `$message` string is concatenated into the exception message thrown by…</p> <p><strong>Affected:</strong> Packagist: redaxo/source</p> <p>### Summary</p> <p>A stored cross-site scripting (XSS) vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type&#39;s `name` field without HTML escaping. An attacker with access to the Media Manager addon can store an XSS payload as a type name; the payload executes in the browser of any administrator who subsequently tries to delete a media file linked to that type&#39;s effects. This can lead to session hijacking and full backend account takeover.</p> <p>---</p> <p>### Details</p> <p>**File:** `redaxo/src/addons/media_manager/lib/media_manager.php` **Function:** `mediaIsInUse()` — registered on the `MEDIA_IS_IN_USE` extension point in `boot.php`</p> <p>When `rex_media_service::deleteMedia()` is called, it invokes `rex_mediapool::mediaIsInUse($filename)`, which fires the `MEDIA_IS_IN_USE` extension point. The media_manager addon&#39;s handler queries all effects whose `parameters` JSON contains the filename, then constructs an HTML anchor with the type name inserted verbatim:</p> <p>```php // media_manager.php ~line 457 ← VULNERABLE $message = &#39;&lt;a href=&#34;javascript:openPage(\&#39;&#39; . rex_url::backendPage(...) . &#39;\&#39;)&#34;&gt;&#39; . rex_i18n::msg(&#39;media_manager&#39;) . &#39; &#39; . rex_i18n::msg(&#39;media_manager_effect_name&#39;) . &#39;: &#39; . (string) $sql-&gt;getValue(&#39;name&#39;) // ← NO rex_escape() call . &#39;&lt;/a&gt;&#39;; ```</p> <p>The returned `$message` string is concatenated into the exception message thrown by…</p> https://vulnerability.circl.lu/vuln/ghsa-mf2p-wjp4-99pq