A vulnerability in certain versions of Octopus Server allows users with the System Manager role to escalate their privileges to full system Administrator. This elevation of privilege could enable unauthorized administrative control over the system.
REDAXO core versions from 5.3.0 up to but not including 5.21.4 contain an authentication bypass vulnerability in the structure/history plugin. This flaw allows unauthenticated attackers to forge temporary login tokens by forcing the session-tied secret into a predictable state. Exploitation can lead to unauthorized backend access, including admin-level privileges, and code execution outside of live mode.
REDAXO versions before 5.21.4 have a broken access control vulnerability that allows authenticated editors to modify slices in categories they are not authorized to access. By pairing a permitted article with a foreign slice ID, attackers can abuse content editing, deletion, and slice status or movement APIs to delete, toggle, move, or overwrite slices belonging to other editors.
REDAXO versions before 5.21.4 have a missing authorization vulnerability in the media pool bulk move feature. The vulnerability arises because the system only checks permissions on the target category and ignores the source category. Authenticated backend users with permission on one media category can move files from restricted categories into their permitted category and replace their contents silently across the site.
In certain versions of Octopus Server, creating a user invitation causes the invitation code to be logged in the audit event log. If the invitation is linked to a space, users with appropriate permissions in that space could read the invitation code from the audit log. An attacker who redeems the unclaimed invitation might escalate privileges depending on the permissions assigned to the invited user. This vulnerability has a high severity rating with a CVSS score of 7.7.
REDAXO versions from 5.18.0 up to but not including 5.21.4 contain a stored cross-site scripting (XSS) vulnerability. This occurs because the rex_media_service component moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can exploit a race condition or exhaust memory limits to leave malicious script-laden SVG files accessible, leading to script execution in victims' backend sessions.
JetBrains Junie CLI versions prior to 26.8.17 contain a vulnerability that allows command execution due to incomplete validation of allowlisted commands. This flaw could enable an attacker with limited privileges to execute arbitrary commands. The issue has been assigned CVE-2026-117530 and carries a CVSS score of 6.7, indicating a medium severity level.
REDAXO versions before 5.21.4 have a stored cross-site scripting (XSS) vulnerability. This flaw allows content editors to inject malicious HTML by submitting crafted input values that are stored and later rendered without proper escaping in media-related widgets. Exploitation can lead to script execution in administrators' backend sessions, potentially hijacking their accounts.
REDAXO versions before 5.21.5 have a cross-site request forgery (CSRF) vulnerability in the backend. The vulnerability arises because the safemode GET parameter in index.php is processed without validating a CSRF token. An attacker can exploit this by tricking a logged-in administrator into clicking a crafted link, which can disable global safe mode or enable session safe mode, potentially impacting backend addon functionality.
REDAXO core versions before 5.21.4 have a missing authorization vulnerability in the structure/version and structure/history frontend preview modes. These modes fail to verify category or clang permissions for the previewed article, allowing any backend user or users with the history[article_rollback] permission to access unpublished, historic, or deleted content by manipulating preview parameters.
REDAXO versions before 5.21.5 have a missing authorization vulnerability in the backup addon export feature. This flaw allows non-admin users with the backup[export] permission to export any database table, including sensitive tables such as rex_user and rex_user_session. Exploitation can lead to attackers obtaining plaintext session IDs and stay-logged-in keys to hijack admin accounts or password hashes for offline cracking.
SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious markup via the search parameter in the extended Special:Search profile. The vulnerability arises because the ProfileForm::profile_sheet function inserts unescaped user input into a pre element, enabling script execution in the context of the wiki origin when crafted URLs with SVG event handlers are used.
SemanticMediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious script via Code-typed property values. The vulnerability arises because attackers can embed HTML markup inside a valid JSON value, which is then rendered unescaped on the Special:Browse page, leading to JavaScript execution in the browsers of users viewing the page.
REDAXO core versions prior to 5.21.5 have a missing authorization vulnerability in the rex_api_package API function. This flaw allows non-admin backend users who possess a valid CSRF token to manage packages, including uninstalling system addons, deactivating, installing, activating, or deleting packages. Attackers with such tokens, for example demoted admins with active sessions, can cause significant disruption such as dropping database tables of system addons.
SemanticMediaWiki versions from 4.2.0 up to but not including 7.2.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious HTML and execute scripts in users' browsers via crafted URLs targeting the Special:FacetedSearch page. The vulnerability arises from unescaped cstate parameters that break out of hidden input attributes. The CVSS 3.1 base score is 6.1, indicating a medium severity issue.
REDAXO versions prior to 5.21.5 have a vulnerability related to insufficient session expiration. This flaw allows attackers who have obtained a user's session ID or stay-logged-in cookie to maintain backend access even after the user changes their password. The stay-logged-in cookie remains valid for up to three months, enabling prolonged unauthorized access.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.0 have a missing authorization vulnerability in the api.php smwtask module. This flaw allows unauthenticated attackers to perform admin-only maintenance tasks by leveraging the public anonymous CSRF token. Exploitation can lead to reading internal store statistics, enqueuing jobs such as smw.entityIdDisposer, and executing these jobs, which may degrade system performance and alter semantic data.
SemanticMediaWiki versions from 3.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with the smw-schemaedit permission to inject malicious script code via the canonical_name property of a property group schema. The injected script is rendered unescaped in Special:Browse headings by GroupFormatter, leading to JavaScript execution in the context of viewers, including administrators.
Semantic MediaWiki versions from 4.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with profile or schema editing permissions to inject malicious HTML through FacetedSearch exploration-link labels. The injected markup is passed unescaped to the page rendering function, potentially enabling script execution in the browsers of users viewing the affected Special:FacetedSearch page.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious scripts via External identifier property values. The injected scripts are rendered unescaped on the Special:Browse page, enabling execution of JavaScript in the context of viewers' sessions, including administrators. The vulnerability has a medium severity rating with a CVSS score of 5.4.