Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

redaxo/source

18 known vulnerabilities (4 high, 12 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
18 · 4 high, 12 medium, 2 low
Registry
Packagist

Advisories 18

  • REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

    Affected: fixed in 5.21.0.

  • REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

    Affected: fixed in 5.21.0.

  • CVE-2026-63000Medium 6.4

    REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

    Affected: fixed in 5.21.2.

  • CVE-2026-62998Medium 4.3

    REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

    Affected: fixed in 5.21.2.

  • CVE-2026-63002Medium 4.8

    REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

    Affected: fixed in 5.21.2.

  • CVE-2026-63001Medium 4.8

    REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

    Affected: fixed in 5.21.2.

  • Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php…

    Affected: from 5.18.2, fixed in 5.21.1.

  • Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

    Affected: fixed in 5.20.2.

  • CVE-2025-66026Medium 6.1

    REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]

    Affected: fixed in 5.20.1.

  • A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated…

    Affected: fixed in 5.20.1.

  • CVE-2025-64049Medium 4.8

    A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject…

    Affected: fixed in 5.20.1.

  • CVE-2025-27412Medium 6.1

    REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation

    Affected: from 5.0.0, fixed in 5.18.3.

  • CVE-2025-27411Medium 5.4

    REDAXO allows Arbitrary File Upload in the mediapool page

    Affected: fixed in 5.18.3.

  • CVE-2024-13209Medium 5.1

    Redaxo CMS Structure Management Page index.php cross site scripting

    Affected: from 5.12.0-beta1, fixed in 5.18.2.

  • CVE-2024-46209Medium 5.4

    A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute…

    Affected: through 5.17.1.

Show all 18 advisoriesShow fewer advisories
  • CVE-2024-50803Medium 6.1

    The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote…

    Affected: fixed in 5.18.0.

  • CVE-2024-46212Medium 4.9

    An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.

    Affected: through 5.17.1.

  • An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via…

    Affected: through 5.15.1.