Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: redaxo core 5.21.5 Clear all filters
TI-2026-81103 CVE-2026-116896 · GHSA-c532-w5jh-m2g6

Missing authorization in REDAXO backup export exposes user tables

Priority LOW 35

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_ses…

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00223 Published 2026-10-27 Fixed in 5.21.5 CWE-862
TI-2026-81102 CVE-2026-116895 · GHSA-qx28-m2wr-99m4

REDAXO CSRF via Safe Mode Toggle Parameter

Priority LOW 22

REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.00099 Published 2026-10-27 Fixed in 5.21.5 CWE-352
TI-2026-81101 CVE-2026-116894 · GHSA-5q2r-xq89-8ccv

Insufficient session expiration in REDAXO lets sessions survive password changes

Priority LOW 11

REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change.

CVSS 4.0LOW 2.3 Network Low privileges No interaction EPSS 0.00163 Published 2026-10-27 Fixed in 5.21.5 CWE-613
TI-2026-81100 CVE-2026-116893 · GHSA-hcxm-g8rr-hmvw

Missing authorization in REDAXO core package API

Priority LOW 29

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token.

CVSS 4.0MEDIUM 6.1 Network Low privileges No interaction EPSS 0.00252 Published 2026-10-27 Fixed in 5.21.5 CWE-862