Priority HIGH 73
Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file extension blacklist restrictions.
CVSS 4.0HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00452 · Published 2026-05-23 · No fix listed CWE-863
Priority HIGH 69
REDAXO is a PHP-based content management system.
CVSS 4.0HIGH 8.3· Network · High privileges · No interaction · EPSS 0.00535 · Published 2026-01-07 · Fixed in 5.20.2 CWE-22
Priority HIGH 68
REDAXO is a PHP-based content management system.
CVSS 3.1HIGH 7.5· Network · Low privileges · No interaction · EPSS 0.00508 · Published 2026-07-31 · Fixed in 5.21.1 CWE-434
Priority HIGH 67
A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into a…
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00973 · Published 2025-11-25 · Fixed in 5.20.1 CWE-94
Priority HIGH 67
REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01025 · Published 2024-10-16 · No fix listed
Priority HIGH 67
An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00585 · Published 2025-01-10 · No fix listed CWE-434
Priority HIGH 67
Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.0148 · Published 2024-02-14 · No fix listed CWE-94
Priority HIGH 67
An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01108 · Published 2024-02-17 · No fix listed CWE-94
Priority MEDIUM 64
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages.
CVSS 4.0MEDIUM 6.9· Network · No auth · No interaction · EPSS 0.00152 · Published 2026-04-04 · No fix listed CWE-352
Priority MEDIUM 62
REDAXO is a PHP-based content management system.
CVSS 3.1MEDIUM 6.4· Network · No auth · User interaction · EPSS 0.00149 · Published 2026-09-23 · Fixed in 5.21.2 CWE-352
Priority MEDIUM 60
REDAXO is a PHP-based CMS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00287 · Published 2025-11-26 · Fixed in 5.20.1 CWE-79
Priority MEDIUM 60
REDAXO is a PHP-based CMS.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00287 · Published 2025-03-05 · Fixed in 5.18.3 CWE-79
Priority MEDIUM 58
REDAXO is a PHP-based CMS.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00281 · Published 2025-03-05 · Fixed in 5.18.3 CWE-434
Priority MEDIUM 58
A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parame…
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00425 · Published 2025-01-06 · No fix listed CWE-79
Priority MEDIUM 56
An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00866 · Published 2024-10-16 · No fix listed CWE-22
Priority MEDIUM 56
A vulnerability was found in Redaxo CMS 5.18.1.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.004 · Published 2025-01-09 · Fixed in 5.18.2 CWE-79
Priority MEDIUM 55
REDAXO is a PHP-based content management system.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00197 · Published 2026-09-23 · Fixed in 5.21.2 CWE-79
Priority MEDIUM 55
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00332 · Published 2025-11-25 · Fixed in 5.20.1 CWE-79
Priority MEDIUM 53
REDAXO is a PHP-based content management system.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00388 · Published 2026-09-23 · Fixed in 5.21.2 CWE-20
Priority MEDIUM 49
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens.
CVSS 4.0CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00679 · Published 2026-10-27 · Fixed in 5.21.4 CWE-287
Priority MEDIUM 46
In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02053 · Published 2018-10-01 · No fix listed CWE-89
Priority MEDIUM 45
There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01421 · Published 2018-10-09 · No fix listed CWE-89
Priority MEDIUM 44
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping.
CVSS 4.0LOW 2.1· Network · High privileges · No interaction · EPSS 0.00179 · Published 2026-10-27 · Fixed in 5.21.0 CWE-79
Priority MEDIUM 44
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path…
CVSS 4.0HIGH 8.6· Network · No auth · User interaction · EPSS 0.00135 · Published 2026-10-27 · Fixed in 5.21.3 CWE-352
Priority LOW 39
Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting system via a module containing malicious PHP code.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.04894 · Published 2021-09-09 · No fix listed CWE-78
Load more
THREATIST.IORead the docs