Threats tagged 'ghsa-4rfx-xhx7-wf22'

REDAXO versions prior to 5.21.0 have a reflected cross-site scripting (XSS) vulnerability in the backend packages API. The flaw arises because a function parameter is concatenated into an error message without proper HTML escaping. An attacker can exploit this by tricking an authenticated backend user into clicking a crafted link containing a valid CSRF token, leading to execution of malicious JavaScript that can perform same-origin actions or read DOM data.