[ Vendor · 4 CVEs ]
redaxo
CVEs affecting redaxo published in the last 30 days, plus any redaxo CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-62998 | 23 Sep 2026 | CVSS 4.3 | REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column EnumerationREDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request… | Fix |
| CVE-2026-63000 | 23 Sep 2026 | CVSS 6.4 | REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon UpdatesREDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in… | Fix |
| CVE-2026-63001 | 23 Sep 2026 | CVSS 4.8 | REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php… | Fix |
| CVE-2026-63002 | 23 Sep 2026 | CVSS 4.8 | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem FilenamesREDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles… | Fix |