Redaxo Core
20 CVEs affecting Redaxo Core. Latest disclosed: 2026-10-27. Critical: 1, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-117532 | Critical | 9.8 | 2026-10-27 | REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to f… |
CVE-2026-117536 | High | 8.8 | 2026-10-27 | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check onl… |
CVE-2026-116896 | High | 7.5 | 2026-10-27 | REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with t… |
CVE-2026-53599 | High | 7.5 | 2026-07-31 | REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php l… |
CVE-2026-116898 | High | 7.1 | 2026-10-27 | REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the sourc… |
CVE-2026-116893 | Medium | 6.8 | 2026-10-27 | REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages… |
CVE-2026-116899 | Medium | 6.5 | 2026-10-27 | REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a… |
CVE-2026-116897 | Medium | 6.5 | 2026-10-27 | REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not ch… |
CVE-2026-63000 | Medium | 6.4 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php in… |
CVE-2026-117535 | Medium | 6.1 | 2026-10-27 | REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered… |
CVE-2026-117534 | Medium | 5.4 | 2026-10-27 | REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back c… |
CVE-2026-116900 | Medium | 5.4 | 2026-10-27 | REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by me… |
CVE-2026-116895 | Medium | 5.4 | 2026-10-27 | REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validati… |
CVE-2026-63002 | Medium | 4.8 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the medi… |
CVE-2026-63001 | Medium | 4.8 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a… |
CVE-2026-117533 | Medium | 4.4 | 2026-10-27 | REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media… |
CVE-2026-62998 | Medium | 4.3 | 2026-09-23 | REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter… |
CVE-2026-116894 | Medium | 4.2 | 2026-10-27 | REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session an… |
CVE-2026-117538 | Medium | 4.1 | 2026-10-27 | REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an… |
CVE-2026-117537 | Medium | 4.1 | 2026-10-27 | REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of th… |