# cve.now: Redaxo

The newest entries naming Redaxo as an affected vendor (up to 200), of 27 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-117538](https://cve.now/CVE-2026-117538.md): REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter (CVSS 2.1)
- [CVE-2026-117537](https://cve.now/CVE-2026-117537.md): REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter (CVSS 2.1)
- [CVE-2026-117536](https://cve.now/CVE-2026-117536.md): REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation (CVSS 8.6)
- [CVE-2026-117535](https://cve.now/CVE-2026-117535.md): REDAXO before 5.21.3 Reflected XSS via opener\_link in Media Pool (CVSS 5.1)
- [CVE-2026-117534](https://cve.now/CVE-2026-117534.md): REDAXO before 5.21.3 CSRF in Article History Plugin (CVSS 5.1)
- [CVE-2026-117533](https://cve.now/CVE-2026-117533.md): REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads (CVSS 2.1)
- [CVE-2026-117532](https://cve.now/CVE-2026-117532.md): REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin (CVSS 9.3)
- [CVE-2026-116900](https://cve.now/CVE-2026-116900.md): REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets (CVSS 5.1)
- [CVE-2026-116899](https://cve.now/CVE-2026-116899.md): REDAXO before 5.21.4 Broken Access Control in Slice Operations (CVSS 7.1)
- [CVE-2026-116898](https://cve.now/CVE-2026-116898.md): REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move (CVSS 7.1)
- [CVE-2026-116897](https://cve.now/CVE-2026-116897.md): REDAXO before 5.21.4 Missing Authorization in Version and History Previews (CVSS 7.1)
- [CVE-2026-116896](https://cve.now/CVE-2026-116896.md): REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables (CVSS 7.7)
- [CVE-2026-116895](https://cve.now/CVE-2026-116895.md): REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter (CVSS 5.1)
- [CVE-2026-116894](https://cve.now/CVE-2026-116894.md): REDAXO before 5.21.5 Insufficient Session Expiration on Password Change (CVSS 2.3)
- [CVE-2026-116893](https://cve.now/CVE-2026-116893.md): REDAXO core before 5.21.5 Missing Authorization in rex\_api\_package API (CVSS 6.1)
- [CVE-2026-63000](https://cve.now/CVE-2026-63000.md): REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates (CVSS 6.4)
- [CVE-2026-62998](https://cve.now/CVE-2026-62998.md): REDAXO: Unwhitelisted ORDER BY Column in rex\_list Allows Authenticated Column Enumeration (CVSS 4.3)
- [CVE-2026-63002](https://cve.now/CVE-2026-63002.md): REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames (CVSS 4.8)
- [CVE-2026-63001](https://cve.now/CVE-2026-63001.md): REDAXO: Stored XSS via Unescaped Media Manager Type Name in \`mediaIsInUse()\` (CVSS 4.8)
- [CVE-2026-53599](https://cve.now/CVE-2026-53599.md): Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod\_php multi-extension handlers (CVSS 7.5)
- [CVE-2018-25353](https://cve.now/CVE-2018-25353.md): Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload (CVSS 8.7)
- [CVE-2016-20053](https://cve.now/CVE-2016-20053.md): Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint (CVSS 6.9)
- [CVE-2026-21857](https://cve.now/CVE-2026-21857.md): Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read (CVSS 8.3)
- [CVE-2025-66026](https://cve.now/CVE-2025-66026.md): REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args\[types\] (CVSS 6.1)
- [CVE-2025-27412](https://cve.now/CVE-2025-27412.md): REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation (CVSS 6.1)
- [CVE-2025-27411](https://cve.now/CVE-2025-27411.md): REDAXO allows Arbitrary File Upload in the mediapool page (CVSS 5.4)
- [CVE-2024-13209](https://cve.now/CVE-2024-13209.md): Redaxo CMS Structure Management Page index.php cross site scripting (CVSS 5.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/redaxo
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.