CVE-2026-129267 | sergix44 XBackBone up to 3.8.2 MediaController.php getRawById cross site scripting (ID 673)

A vulnerability was found in sergix44 XBackBone up to 3.8.2. It has been declared as problematic. Impacted is the function MediaController::getRawById of the file app/Controllers/MediaController.php. The manipulation results in cross site scripting.

This vulnerability is known as CVE-2026-129267. It is possible to launch the attack remotely. Furthermore, an exploit is available.

The pull request to fix this issue awaits acceptance.VulDB Recent EntriesRead More