VYPR
← All advisories
Medium severity5.4OSV Advisory· Published Oct 1, 2018· Updated Jun 17, 2026

CVE-2018-17830

CVE-2018-17830

Description

The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricted). The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=&args[ substring.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Redaxo/RedaxoOSV2 versions
    5.0.0, 5.0.0-alpha7, 5.0.0-beta1, …+ 1 more
    • (no CPE)range: 5.0.0, 5.0.0-alpha7, 5.0.0-beta1, …
    • (no CPE)range: <=5.6.2

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.