Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: redaxo core 5.21.4 Clear all filters
TI-2026-81109 CVE-2026-117533 · GHSA-7mw4-9872-fvq7

Stored XSS in REDAXO mediapool through unsanitized SVG uploads

Priority LOW 10

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them.

CVSS 4.0LOW 2.1 Network Low privileges User interaction EPSS 0.00127 Published 2026-10-27 Fixed in 5.21.4 CWE-79
TI-2026-81108 CVE-2026-117532 · GHSA-v3wh-4qp2-g2hm

Authentication bypass in REDAXO Core history plugin allows token forgery

Priority MEDIUM 49

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00679 Published 2026-10-27 Fixed in 5.21.4 CWE-287
TI-2026-81107 CVE-2026-116900 · GHSA-34c3-hq82-r6qj

Stored XSS in REDAXO media and link input widgets

Priority LOW 22

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00138 Published 2026-10-27 Fixed in 5.21.4 CWE-79
TI-2026-81106 CVE-2026-116899 · GHSA-v2qf-q3h8-xpm7

REDAXO slice operations allow editors to modify others' slices

Priority LOW 30

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00181 Published 2026-10-27 Fixed in 5.21.4 CWE-639
TI-2026-81105 CVE-2026-116898 · GHSA-j6f9-3wr6-g69x

Missing authorization in REDAXO media pool bulk move

Priority LOW 30

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00168 Published 2026-10-27 Fixed in 5.21.4 CWE-639
TI-2026-81104 CVE-2026-116897 · GHSA-f7g4-vhhq-7w9x

Missing authorization in REDAXO version and history previews

Priority LOW 31

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00209 Published 2026-10-27 Fixed in 5.21.4 CWE-862