Redaxo vulnerabilities
27 CVEs and advisories name Redaxo as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-117538REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter
- CVE-2026-117537REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter
- CVE-2026-117536REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
- CVE-2026-117535REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
- CVE-2026-117534REDAXO before 5.21.3 CSRF in Article History Plugin
- CVE-2026-117533REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
- CVE-2026-117532REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
- CVE-2026-116900REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets
- CVE-2026-116899REDAXO before 5.21.4 Broken Access Control in Slice Operations
- CVE-2026-116898REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
- CVE-2026-116897REDAXO before 5.21.4 Missing Authorization in Version and History Previews
- CVE-2026-116896REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
- CVE-2026-116895REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
- CVE-2026-116894REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
- CVE-2026-116893REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
- CVE-2026-63000REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
- CVE-2026-62998REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
- CVE-2026-63002REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
- CVE-2026-63001REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
- CVE-2026-53599Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
- CVE-2018-25353Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload
- CVE-2016-20053Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint
- CVE-2026-21857Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
- CVE-2025-66026REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
- CVE-2025-27412REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation
- CVE-2025-27411REDAXO allows Arbitrary File Upload in the mediapool page
- CVE-2024-13209Redaxo CMS Structure Management Page index.php cross site scripting