Skip to content
OpenAdvisories

Package · Packagist

redaxo/source

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Medium 4.1
    CVE-2026-117538

    REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

    REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a …

    redaxo core redaxo/source Packagist
  • Medium 4.1
    CVE-2026-117537

    REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

    REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML pa…

    redaxo core redaxo/source Packagist
  • Medium 6.4
    CVE-2026-63000

    REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

    REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF…

    redaxo core redaxo/source Packagist
  • Medium 4.3
    CVE-2026-62998

    REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

    REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backe…

    redaxo core redaxo/source Packagist
  • Medium 4.8
    CVE-2026-63002

    REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

    REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregis…

    redaxo core redaxo/source Packagist
  • Medium 4.8
    CVE-2026-63001

    REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

    REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDI…

    redaxo core redaxo/source Packagist
  • Medium 6.1
    CVE-2025-66026

    REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]

    REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScri…

    redaxo redaxo redaxo/source Packagist
  • Medium 4.8
    CVE-2025-64049

    REDAXO CMS is vulnerable to XSS through its module management component

    A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an ar…

    redaxo/source Packagist
  • Medium 6.1
    CVE-2025-27412

    REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation

    REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting (XSS) on the page of AddOns. This vulnerability is fixed in 5.18.3.

    redaxo redaxo redaxo/source Packagist
  • Medium 5.4
    CVE-2025-27411

    REDAXO allows Arbitrary File Upload in the mediapool page

    REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.

    redaxo redaxo redaxo/source Packagist
  • Medium 5.4
    CVE-2024-46209 Public exploit

    REDAXO CMS Cross-site Scripting vulnerability

    A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter.

    redaxo/source Packagist
  • Medium 6.1
    CVE-2024-50803 Public exploit

    Redaxo Core CMS Cross Site Scripting (XSS)

    The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges

    redaxo/source Packagist
  • Medium 4.9
    CVE-2024-46212

    Path traversal in redaxo

    An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.

    redaxo/source Packagist