CVE-2026-53599 | High | 7.5 | 2026-07-31 | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php l… |
CVE-2018-25353 | High | 8.8 | 2026-05-23 | Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file extension blacklist r… |
CVE-2016-20053 | Medium | 5.3 | 2026-04-04 | Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking aut… |
CVE-2026-21857 | Medium | 6.5 | 2026-01-07 | REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webro… |
CVE-2025-66026 | Medium | 6.1 | 2025-11-26 | REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request paramet… |
CVE-2025-64050 | High | 7.2 | 2025-11-25 | A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arb… |
CVE-2025-64049 | Medium | 4.8 | 2025-11-25 | A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or… |
CVE-2025-27412 | Medium | 6.1 | 2025-03-05 | REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting (XSS) on the page… |
CVE-2025-27411 | Medium | 5.4 | 2025-03-05 | REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3. |
CVE-2024-46210 | High | 7.2 | 2025-01-10 | An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file. |
CVE-2024-13209 | Low | 2.4 | 2025-01-09 | A vulnerability was found in Redaxo CMS 5.18.1. It has been classified as problematic. Affected is an unknown function of the file /index.php?page=structure&ca… |
CVE-2024-46209 | Medium | 5.4 | 2025-01-06 | A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or… |
CVE-2024-50803 | Medium | 5.4 | 2024-11-19 | The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privile… |
CVE-2024-46213 | High | 7.2 | 2024-10-16 | REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability. |
CVE-2024-46212 | Medium | 4.9 | 2024-10-16 | An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal. |
CVE-2024-25298 | High | 7.2 | 2024-02-17 | An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php. |
CVE-2024-25301 | High | 7.2 | 2024-02-14 | Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php. |
CVE-2024-25300 | Medium | 4.8 | 2024-02-14 | A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2021-39459 | High | 7.2 | 2021-09-09 | Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting syst… |
CVE-2021-39458 | Medium | 6.5 | 2021-09-09 | Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vai… |
CVE-2018-18200 | Critical | 9.8 | 2018-10-09 | There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4. |
CVE-2018-18199 | Medium | 6.1 | 2018-10-09 | Mediamanager in REDAXO before 5.6.4 has XSS. |
CVE-2018-18198 | Medium | 6.1 | 2018-10-09 | The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attack… |
CVE-2018-17831 | Critical | 9.8 | 2018-10-01 | In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list… |
CVE-2018-17830 | Medium | 5.4 | 2018-10-01 | The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricte… |
CVE-2018-15850 | High | 8.8 | 2018-08-25 | An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user. |
CVE-2012-3869 | | | 2012-08-13 | Cross-site scripting (XSS) vulnerability in include/classes/class.rex_list.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web scri… |
CVE-2006-2845 | | | 2006-06-06 | PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parame… |
CVE-2006-2844 | | | 2006-06-06 | Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parame… |
CVE-2006-2843 | | | 2006-06-06 | PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the (1) REX[INCLUDE_PATH] parameter… |