Vulnerabilities

TI-2026-45001 CVE-2026-63000 · GHSA-m8r3-22v6-g877

REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

MEDIUM 62

REDAXO is a PHP-based content management system.

CVSS 3.1MEDIUM 6.4 Network No auth User interaction EPSS 0.00149 Published 2026-09-23 Fixed in 5.21.2 CWE-352

TI-2026-44999 CVE-2026-62998 · GHSA-4f5f-j737-pm58

REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

MEDIUM 53

REDAXO is a PHP-based content management system.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00388 Published 2026-09-23 Fixed in 5.21.2 CWE-20

TI-2026-45003 CVE-2026-63002 · GHSA-w998-qmw9-mf4m

REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

MEDIUM 55

REDAXO is a PHP-based content management system.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00197 Published 2026-09-23 Fixed in 5.21.2 CWE-79

TI-2026-45002 CVE-2026-63001 · GHSA-mf2p-wjp4-99pq

REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

LOW 21

REDAXO is a PHP-based content management system.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00197 Published 2026-09-23 Fixed in 5.21.2 CWE-79

TI-2016-09229 CVE-2016-20053 · GHSA-2r3p-9jrg-pvg9

Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint

MEDIUM 64

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00152 Published 2026-04-04 No fix listed CWE-352

TI-2026-17559 CVE-2026-21857 · GHSA-824x-88xg-cwrv

Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

HIGH 69

REDAXO is a PHP-based content management system.

CVSS 4.0HIGH 8.3 Network High privileges No interaction EPSS 0.00535 Published 2026-01-07 Fixed in 5.20.2 CWE-22

TI-2025-40552 CVE-2025-66026 · GHSA-x6vr-q3vf-vqgq

REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]

MEDIUM 60

REDAXO is a PHP-based CMS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00287 Published 2025-11-26 Fixed in 5.20.1 CWE-79

TI-2025-39517 CVE-2025-64050 · GHSA-xj9j-gjxg-7jvq

A Remote Code Execution (RCE) vulnerability in the template management component in…

HIGH 67

A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into a…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00973 Published 2025-11-25 Fixed in 5.20.1 CWE-94

TI-2025-39516 CVE-2025-64049 · GHSA-vqc7-7fj4-3fm3

A stored cross-site scripting (XSS) vulnerability in the module management component in…

MEDIUM 55

A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00332 Published 2025-11-25 Fixed in 5.20.1 CWE-79

TI-2025-20247 CVE-2025-27412 · GHSA-8366-xmgf-334f

REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation

MEDIUM 60

REDAXO is a PHP-based CMS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00287 Published 2025-03-05 Fixed in 5.18.3 CWE-79

TI-2025-20246 CVE-2025-27411 · GHSA-wppf-gqj5-fc4f

REDAXO allows Arbitrary File Upload in the mediapool page

MEDIUM 58

REDAXO is a PHP-based CMS.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00281 Published 2025-03-05 Fixed in 5.18.3 CWE-434

TI-2024-30896 CVE-2024-46210 · GHSA-cc53-v8jq-4w68

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1…

HIGH 67

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00585 Published 2025-01-10 No fix listed CWE-434

TI-2024-12255 CVE-2024-13209 · GHSA-7wj8-856p-qc9m

Redaxo CMS Structure Management Page index.php cross site scripting

MEDIUM 56

A vulnerability was found in Redaxo CMS 5.18.1.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.004 Published 2025-01-09 Fixed in 5.18.2 CWE-79

TI-2024-30895 CVE-2024-46209 · GHSA-2p95-8xvm-2pjx

A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of…

MEDIUM 58

A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parame…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00425 Published 2025-01-06 No fix listed CWE-79

TI-2024-34113 CVE-2024-50803 · GHSA-m5vv-7jxc-8p6x

The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross…

LOW 28

The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges

CVSS 3.1MEDIUM 6.1 Network Low privileges User interaction EPSS 0.00581 Published 2024-11-19 Fixed in 5.18.0 CWE-79

TI-2024-30898 CVE-2024-46213 · GHSA-h6vc-pxj4-pcch

REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.

HIGH 67

REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01025 Published 2024-10-16 No fix listed

TI-2024-30897 CVE-2024-46212 · GHSA-37gm-h5wr-pf25

An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows…

MEDIUM 56

An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00866 Published 2024-10-16 No fix listed CWE-22

TI-2024-16678 CVE-2024-25298 · GHSA-7f2v-5877-rx3x

An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary…

HIGH 67

An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01108 Published 2024-02-17 No fix listed CWE-94

TI-2024-16680 CVE-2024-25301 · GHSA-vr7g-cxmj-9864

Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via…

HIGH 67

Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0148 Published 2024-02-14 No fix listed CWE-94

TI-2024-16679 CVE-2024-25300 · GHSA-6wxp-wm3f-vmr4

A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute…

LOW 22

A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Template section.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00358 Published 2024-02-14 No fix listed CWE-79

TI-2021-16768 CVE-2021-39459 · GHSA-w786-j2g7-7hq5

Remote code execution in the modules component in Yakamara Media Redaxo CMS version…

LOW 39

Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting system via a module containing malicious PHP code.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.04894 Published 2021-09-09 No fix listed CWE-78

TI-2021-16767 CVE-2021-39458 · GHSA-wgx4-mfw2-ccw7

Triggering an error page of the import process in Yakamara Media Redaxo CMS version…

LOW 31

Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01191 Published 2021-09-09 No fix listed CWE-209

TI-2018-12873 CVE-2018-18200 · GHSA-mggx-323c-ww4g

There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.

MEDIUM 45

There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01421 Published 2018-10-09 No fix listed CWE-89

TI-2018-12872 CVE-2018-18199 · GHSA-786w-4844-w367

Mediamanager in REDAXO before 5.6.4 has XSS.

LOW 29

Mediamanager in REDAXO before 5.6.4 has XSS.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00829 Published 2018-10-09 No fix listed CWE-79

TI-2018-12871 CVE-2018-18198 · GHSA-993q-f479-5m8q

The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is…

LOW 29

The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00905 Published 2018-10-09 No fix listed CWE-79

Vulnerabilities

Filters