RE
Product
redaxo
31
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 6Medium 19Low 0
Watch
Add redaxo to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-20053 | 6.5 | Apr 4 | Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint Affected: 5.2 |
| CVE-2026-21857 | 6.5 | Jan 7 | Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Affected: < 5.20.2 |
| CVE-2021-39458 | 6.5 | Sep 9 | Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup Affected: 5.12.1 |
| CVE-2026-63000 | 6.4 | Sep 23 | REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates Affected: before 5.21.2 |
| CVE-2025-66026 | 6.1 | Nov 26 | REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types] Affected: < 5.20.1 |
| CVE-2025-27412 | 6.1 | Mar 5 | REDAXO is a PHP-based CMS Affected: 5.0 before 5.18.3 |
| CVE-2018-18199 | 6.1 | Oct 9 | Mediamanager in REDAXO before 5.6.4 has XSS Affected: before 5.6.4 |
| CVE-2018-18198 | 6.1 | Oct 9 | The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page Affected: 5.6.3 |
| CVE-2025-27411 | 5.4 | Mar 5 | REDAXO is a PHP-based CMS Affected: before 5.18.3 |
| CVE-2024-13209 | 5.4 | Jan 9 | Redaxo CMS Structure Management Page index.php cross site scripting Affected: 5.18.1 |
| CVE-2024-46209 | 5.4 | Jan 6 | A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a… Affected: 5.17.1 |
| CVE-2024-50803 | 5.4 | Nov 19 | The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges Affected: 5.17.1 |
| CVE-2018-17830 | 5.4 | Oct 1 | The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricted) Affected: 5.6.2 |
| CVE-2024-46212 | 4.9 | Oct 16 | An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal Affected: 5.17.1 |
| CVE-2026-63002 | 4.8 | Sep 23 | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames Affected: before 5.21.2 |
| CVE-2026-63001 | 4.8 | Sep 23 | REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` Affected: before 5.21.2 |
| CVE-2025-64049 | 4.8 | Nov 25 | A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output… Affected: 5.20.0 |
| CVE-2024-25300 | 4.8 | Feb 14 | A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in… Affected: 5.15.1 |
| CVE-2026-62998 | 4.3 | Sep 23 | REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration Affected: before 5.21.2 |
Showing 19