Login Request a demo
RE
Vendor
Redaxo
5 products with CVEs on record
55
CVEs
0
On KEV
15
New 30D
Products
CO
core
redaxo
9.8
20 CVEs0 on KEV15 new
RE
Redaxo
Redaxo
9.8
31 CVEs0 on KEV0 new
RC
Redaxo CMS
Redaxo
8.8
2 CVEs0 on KEV0 new
CM
CMS
Redaxo
5.4
1 CVEs0 on KEV0 new
RC
Redaxo CMS Mediapool
Redaxo
8.8
1 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-117538
New
CO
core
redaxo
4.1–Oct 27REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter
CVE-2026-117537
New
CO
core
redaxo
4.1–Oct 27REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter
CVE-2026-117536
New
CO
core
redaxo
8.8–Oct 27REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
CVE-2026-117535
New
CO
core
redaxo
6.1–Oct 27REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
CVE-2026-117534
New
CO
core
redaxo
5.4–Oct 27REDAXO before 5.21.3 CSRF in Article History Plugin
CVE-2026-117533
New
CO
core
redaxo
4.4–Oct 27REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
CVE-2026-117532
New
CO
core
redaxo
9.8–Oct 27REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
CVE-2026-116900
New
CO
core
redaxo
5.4–Oct 27REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets
CVE-2026-116899
New
CO
core
redaxo
6.5–Oct 27REDAXO before 5.21.4 Broken Access Control in Slice Operations
CVE-2026-116898
New
CO
core
redaxo
7.1–Oct 27REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
CVE-2026-116897
New
CO
core
redaxo
6.5–Oct 27REDAXO before 5.21.4 Missing Authorization in Version and History Previews
CVE-2026-116896
New
CO
core
redaxo
7.5–Oct 27REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
CVE-2026-116895
New
CO
core
redaxo
5.4–Oct 27REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
CVE-2026-116894
New
CO
core
redaxo
4.2–Oct 27REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
CVE-2026-116893
New
CO
core
redaxo
6.8–Oct 27REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
CVE-2026-63000
CO
core
redaxo
6.4
0%
Sep 23REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
CVE-2026-62998
CO
core
redaxo
4.3
0%
Sep 23REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
CVE-2026-63002
CO
core
redaxo
4.8
0%
Sep 23REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
CVE-2026-63001
CO
core
redaxo
4.8
0%
Sep 23REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
CVE-2026-53599
CO
core
redaxo
7.5
1%
Jul 31Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
CVE-2018-25353
RC
Redaxo CMS Mediapool
Redaxo
8.8
0%
May 23Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload
CVE-2016-20053
RC
Redaxo CMS
Redaxo
6.5
0%
Apr 4Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint
CVE-2026-21857
RE
Redaxo
Redaxo
6.5
1%
Jan 7REDAXO is a PHP-based content management system
CVE-2025-66026
RE
Redaxo
Redaxo
6.1
0%
Nov 26REDAXO is a PHP-based CMS
CVE-2025-64050
RE
Redaxo
Redaxo
7.2
1%
Nov 25A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating…
CVE-2025-64049
RE
Redaxo
Redaxo
4.8
0%
Nov 25A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output…
CVE-2025-27412
RE
Redaxo
Redaxo
6.1
0%
Mar 5REDAXO is a PHP-based CMS
CVE-2025-27411
RE
Redaxo
Redaxo
5.4
0%
Mar 5REDAXO is a PHP-based CMS
CVE-2024-46210
RE
Redaxo
Redaxo
7.2
1%
Jan 10An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file
CVE-2024-13209
CM
CMS
Redaxo
5.4
0%
Jan 9Redaxo CMS Structure Management Page index.php cross site scripting
CVE-2024-46209
RE
Redaxo
Redaxo
5.4
0%
Jan 6A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a…
CVE-2024-50803
RE
Redaxo
Redaxo
5.4
1%
Nov 19The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges
CVE-2024-46213
RE
Redaxo
Redaxo
7.2
1%
Oct 16REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability
CVE-2024-46212
RE
Redaxo
Redaxo
4.9
1%
Oct 16An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal
CVE-2024-25298
RE
Redaxo
Redaxo
7.2
1%
Feb 17An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php
CVE-2024-25301
RE
Redaxo
Redaxo
7.2
1%
Feb 14Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php
CVE-2024-25300
RE
Redaxo
Redaxo
4.8
0%
Feb 14A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in…
CVE-2021-39459
RE
Redaxo
Redaxo
7.2
5%
Sep 9Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting system via a module…
CVE-2021-39458
RE
Redaxo
Redaxo
6.5
1%
Sep 9Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup
CVE-2018-18200
RE
Redaxo
Redaxo
9.8
1%
Oct 9There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4
CVE-2018-18199
RE
Redaxo
Redaxo
6.1
1%
Oct 9Mediamanager in REDAXO before 5.6.4 has XSS
CVE-2018-18198
RE
Redaxo
Redaxo
6.1
1%
Oct 9The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page
CVE-2018-17831
RE
Redaxo
Redaxo
9.8
2%
Oct 1In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the…
CVE-2018-17830
RE
Redaxo
Redaxo
5.4
1%
Oct 1The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricted)
CVE-2018-15850
RC
Redaxo Cms
Redaxo
8.8
1%
Aug 25An issue was discovered in REDAXO CMS 4.7.2
CVE-2012-3869
RE
Redaxo
Redaxo
–
1%
Aug 13Cross-site scripting (XSS) vulnerability in include/classes/class.rex_list.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the…
CVE-2006-2845
RE
Redaxo
Redaxo
–
4%
Jun 6PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to…
CVE-2006-2844
RE
Redaxo
Redaxo
–
4%
Jun 6Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to (1)…
CVE-2006-2843
RE
Redaxo
Redaxo
–
4%
Jun 6PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the (1) REX[INCLUDE_PATH] parameter in (a)…