Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: redaxo core 5.21.3 Clear all filters
TI-2026-81112 CVE-2026-117536 · GHSA-4rqm-5495-h9jx

REDAXO CSRF Token Bypass in users/users Enables Privilege Escalation

Priority MEDIUM 44

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path…

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00135 Published 2026-10-27 Fixed in 5.21.3 CWE-352
TI-2026-81111 CVE-2026-117535 · GHSA-pmxw-f2gq-hx4c

Reflected XSS via opener_link in REDAXO Media Pool

Priority LOW 23

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00199 Published 2026-10-27 Fixed in 5.21.3 CWE-79
TI-2026-81110 CVE-2026-117534 · GHSA-463p-v63r-mx34

Cross-site request forgery in REDAXO article history plugin

Priority LOW 22

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00099 Published 2026-10-27 Fixed in 5.21.3 CWE-352