CVE-2026-117532

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2026-117532

REDAXO core versions 5.3.0 through 5.21.4 are vulnerable to an authentication bypass within the structure/history plugin. This flaw allows unauthenticated attackers to force the session-tied secret into a predictable state , enabling the forgery of temporary login tokens. An attacker can leverage...

EUVD-2026-110797

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

EUVD-2026-110789

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rexapipackage API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like...

CVE-2026-63001

creationtimestamp| type| source ---|---|--- 2026-09-23 16:35:08+00:00| published-proof-of-concept| https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq...

CVE-2026-63002

creationtimestamp| type| source ---|---|--- 2026-09-23 16:35:06+00:00| published-proof-of-concept| https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m...

CVE-2026-63000

creationtimestamp| type| source ---|---|--- 2026-09-23 16:35:04+00:00| published-proof-of-concept| https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877 2026-09-23 18:31:57+00:00| seen| https://gist.github.com/alon710/c6373b33ac6c019650400085845933ec...

CVE-2024-50803

The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site ScriptingXSS which allows a remote attacker to escalate privileges...

Redaxo Core CMS Cross Site Scripting (XSS)

The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site ScriptingXSS which allows a remote attacker to escalate privileges...

GHSA-M5VV-7JXC-8P6X Redaxo Core CMS Cross Site Scripting (XSS)

The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site ScriptingXSS which allows a remote attacker to escalate privileges...

CVE-2024-50803

The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site ScriptingXSS which allows a remote attacker to escalate privileges...

CVE-2024-50803

The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site ScriptingXSS which allows a remote attacker to escalate privileges...

CVE-2024-50803

The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site ScriptingXSS which allows a remote attacker to escalate privileges...

CVE-2024-50803: Improper Neutralization of Input During Web Page Generation

The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site ScriptingXSS which allows a remote attacker to escalate privileges...

CVE-2024-50803

The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site ScriptingXSS which allows a remote attacker to escalate privileges...

CVE-2024-50803

The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site ScriptingXSS which allows a remote attacker to escalate privileges...

PT-2024-34414 · Redaxo · Redaxo Core Cms

Name of the Vulnerable Software and Affected Versions: Redaxo Core CMS version 5.17.1 Description: The mediapool feature of the Redaxo Core CMS application is vulnerable to Cross Site Scripting XSS, which allows a remote attacker to escalate privileges. Recommendations: For Redaxo Core CMS versio...