REDAXO core versions before 5.21.4 have a stored cross-site scripting (XSS) vulnerability. This flaw allows content editors to inject malicious HTML via unescaped values in media, medialist, link, and linklist widgets. Attackers can craft input values that break out of HTML attributes, enabling script execution in administrator backend sessions and potentially hijacking accounts. The vulnerability is fixed in version 5.21.4.
REDAXO core versions before 5.21.4 have an authorization bypass vulnerability that allows authenticated editors to modify slices in categories they are not authorized to access. By pairing a permitted article with a foreign slice ID, attackers can delete, toggle, move, or overwrite slices belonging to other editors via content editing and slice management APIs.
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide.
REDAXO core versions before 5.21.4 have a missing authorization vulnerability in the structure/version and structure/history frontend preview modes. These modes do not verify category or clang permissions for the previewed article, allowing any backend user or users with the history[article_rollback] permission to access unpublished, historic, or deleted content by manipulating parameters.
REDAXO core versions before 5.21.5 have a missing authorization vulnerability in the backup addon export functionality. This flaw allows non-admin users with the backup[export] permission to export sensitive database tables, including rex_user and rex_user_session. Exploiting this, attackers can obtain plaintext session IDs and stay-logged-in keys to hijack admin accounts or acquire password hashes for offline cracking.
REDAXO core versions before 5.21.5 have a cross-site request forgery (CSRF) vulnerability in the backend. The vulnerability arises because the safemode GET parameter in index.php is processed without validating a CSRF token. An attacker can exploit this by tricking a logged-in administrator into clicking a crafted link that disables global safe mode or enables session safe mode, affecting backend addon functionality.
REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months.
REDAXO core versions before 5.21.5 have a missing authorization vulnerability in the rex_api_package API function. This flaw allows non-admin backend users who possess a valid CSRF token to manage packages, including uninstalling system addons, deactivating, installing, activating packages, and deleting non-system packages. The vulnerability is fixed in version 5.21.5.
CVE-2026-117466 is a privilege escalation vulnerability in Octopus Deploy's Octopus Server. Users with the System Manager role can escalate their privileges to full system Administrator. This affects specific versions prior to fixed releases in 2026.2.13469 and 2026.3.15863. The vulnerability has a high severity score of 8.6 and does not require user interaction for exploitation.
CVE-2026-117341 is a vulnerability in Octopus Deploy Octopus Server where creating a user invitation causes the invitation code to be logged in the audit event log. Users with appropriate permissions in the linked space can read this code and potentially redeem the invitation to escalate privileges. The impact depends on the permissions assigned to the invited user. This issue affects specific versions of Octopus Server and has been fixed in versions 2026.2.13438 and 2026.3.15829.
CVE-2026-116870 is a high-severity vulnerability in Octopus Deploy Octopus Server where OIDC token issuer validation was inconsistently performed. This flaw could allow a token from a non-legitimate issuer to be accepted as if it belonged to a legitimate trusted service account. Exploitation requires a service account with an OIDC identity configured and some knowledge of that identity. Fixed versions are available.
SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious markup via the search parameter of the extended Special:Search profile. The vulnerability arises because the ProfileForm::profile_sheet function inserts unescaped user input into a pre element, enabling script execution in the context of the wiki origin. The issue is fixed in version 7.3.1.
SemanticMediaWiki versions from 4.2.0 up to but not including 7.2.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:FacetedSearch feature. This flaw allows unauthenticated attackers to inject arbitrary HTML and execute scripts in the browsers of users who visit crafted URLs containing malicious cstate parameters. The vulnerability arises from improper neutralization of input during web page generation, specifically due to unescaped cstate parameters that break out of hidden input attributes. A fix for this issue is available in version 7.2.1.
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSRF token to read internal store statistics, enqueue jobs like smw.entityIdDisposer, and execute queued jobs, degrading performance and altering semantic data.
SemanticMediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious scripts via Code-typed property values. The vulnerability arises because the CodeStringValueFormatter renders annotated JSON values with embedded HTML markup unescaped on the Special:Browse page, enabling execution of JavaScript in the browsers of users viewing the page. The issue is fixed in version 7.3.1.
SemanticMediaWiki versions from 3.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with the smw-schemaedit right to inject malicious script code via the canonical_name property of a property group schema. The injected script is rendered unescaped in Special:Browse headings by GroupFormatter, leading to JavaScript execution in the browsers of users viewing those pages, including administrators. The vulnerability is fixed in version 7.3.1.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious HTML via Keyword-typed property values that are rendered without proper escaping on the Special:Browse page. Exploitation can lead to execution of arbitrary JavaScript in the context of other users' sessions, including administrators, potentially enabling token theft and unauthorized actions.
Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject scripts via External identifier property values. Attackers can annotate markup payloads that ExternalIdentifierValue renders unescaped on Special:Browse, executing JavaScript in viewers' sessions, including administrators.
Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:SMWAdmin ID lookup feature. This vulnerability allows unauthenticated attackers to inject malicious markup via the unescaped 'id' parameter. An attacker can trick an smw-admin administrator into clicking a crafted link, bypassing the auto-satisfied edit-token check, which leads to script execution and potentially privileged actions within the administrator's session. The issue is fixed in version 7.3.1.