RE
Product
redaxo
31
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 6Medium 19Low 0
Watch
Add redaxo to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-18200 | 9.8 | Oct 9 | There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4 Affected: before 5.6.4 |
| CVE-2018-17831 | 9.8 | Oct 1 | In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the… Affected: before 5.6.3 |
| CVE-2025-64050 | 7.2 | Nov 25 | A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating… Affected: 5.20.0 |
| CVE-2024-46210 | 7.2 | Jan 10 | An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file Affected: 5.17.1 |
| CVE-2024-46213 | 7.2 | Oct 16 | REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability Affected: 2.11.0 |
| CVE-2024-25298 | 7.2 | Feb 17 | An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php Affected: 5.15.1 |
| CVE-2024-25301 | 7.2 | Feb 14 | Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php Affected: 5.15.1 |
| CVE-2021-39459 | 7.2 | Sep 9 | Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting system via a module… Affected: 5.12.1 |
| CVE-2016-20053 | 6.5 | Apr 4 | Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint Affected: 5.2 |
| CVE-2026-21857 | 6.5 | Jan 7 | Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Affected: < 5.20.2 |
| CVE-2021-39458 | 6.5 | Sep 9 | Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup Affected: 5.12.1 |
| CVE-2026-63000 | 6.4 | Sep 23 | REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates Affected: before 5.21.2 |
| CVE-2025-66026 | 6.1 | Nov 26 | REDAXO is a PHP-based CMS Affected: before 5.20.1 |
| CVE-2025-27412 | 6.1 | Mar 5 | REDAXO is a PHP-based CMS Affected: 5.0 before 5.18.3 |
| CVE-2018-18199 | 6.1 | Oct 9 | Mediamanager in REDAXO before 5.6.4 has XSS Affected: before 5.6.4 |
| CVE-2018-18198 | 6.1 | Oct 9 | The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page Affected: 5.6.3 |
| CVE-2025-27411 | 5.4 | Mar 5 | REDAXO is a PHP-based CMS Affected: before 5.18.3 |
| CVE-2024-13209 | 5.4 | Jan 9 | Redaxo CMS Structure Management Page index.php cross site scripting Affected: 5.18.1 |
| CVE-2024-46209 | 5.4 | Jan 6 | A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a… Affected: 5.17.1 |
| CVE-2024-50803 | 5.4 | Nov 19 | The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges Affected: 5.17.1 |
| CVE-2018-17830 | 5.4 | Oct 1 | The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricted) Affected: 5.6.2 |
| CVE-2024-46212 | 4.9 | Oct 16 | An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal Affected: 5.17.1 |
| CVE-2026-63002 | 4.8 | Sep 23 | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames Affected: before 5.21.2 |
| CVE-2026-63001 | 4.8 | Sep 23 | REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` Affected: before 5.21.2 |
| CVE-2025-64049 | 4.8 | Nov 25 | A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output… Affected: 5.20.0 |
| CVE-2024-25300 | 4.8 | Feb 14 | A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in… Affected: 5.15.1 |
| CVE-2026-62998 | 4.3 | Sep 23 | REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration Affected: before 5.21.2 |
| CVE-2012-3869 | – | Aug 13 | Cross-site scripting (XSS) vulnerability in include/classes/class.rex_list.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the… Affected: 4.3; 4.3.1; 4.3.2; 4.3.3; 4.4 |
| CVE-2006-2844 | – | Jun 6 | Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to (1)… Affected: 3.0 |
| CVE-2006-2843 | – | Jun 6 | PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the (1) REX[INCLUDE_PATH] parameter in (a)… Affected: 2.7.4 |
| CVE-2006-2845 | – | Jun 6 | PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to… Affected: 3.0; 3.2 |
Showing 31