CVE-2026-117538
LOW
INFO
Priority: 0.00
BB Relevance:
49/100
Published: 2026-10-27
Modified: 2026-10-27
First seen: 2026-10-29
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
High
UI:
None
S:
X
AT:
Present
VC:
Low
VI:
Low
VA:
Low
Description
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.