Medium severity · published Nov 25, 2025
CVE-2025-64049
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output…
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Redaxo · Redaxo
5.20.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-64049
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-64049
Exploit
https://drive.google.com/drive/folders/1SpwL548ZBRYU_uL8W7Riv7VHshr2UN0R?usp=sharing
Product
https://github.com/redaxo/redaxo
Exploit
https://github.com/vettrivel007/CVE-Disclosures/blob/main/CVE-2025-64049.md
More from Redaxo
9.8
CVE-2018-18200
There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4
9.8
CVE-2018-17831
In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the…
7.2
CVE-2025-64050
A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating…
7.2
CVE-2024-46210
An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file
7.2
CVE-2024-46213
REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability