CVE-2025-27412 REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation

REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting XSS on the page of AddOns. This vulnerability is fixed in 5.18.3...

CVE-2025-27412 REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation

REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting XSS on the page of AddOns. This vulnerability is fixed in 5.18.3...

CVE-2025-27412

CVE-2025-27412 concerns the REDAXO PHP-based CMS. Versions 5.0.0 through 5.18.2 expose a reflected XSS vulnerability in the rex-api-result parameter on the AddOns page. The issue allows an attacker to inject malicious scripts via crafted input, potentially affecting affected administrator session...

CVE-2025-27411 REDAXO allows Arbitrary File Upload in the mediapool page

REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3...

CVE-2025-27411 REDAXO allows Arbitrary File Upload in the mediapool page

REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3...

CVE-2025-27411 REDAXO allows Arbitrary File Upload in the mediapool page

REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3...

CVE-2025-27411

CVE-2025-27411 concerns REDAXO, a PHP-based CMS. The vulnerability is in the mediapool/media page prior to version 5.18.3, where insufficient validation allows an arbitrary file upload. Documents consistently state that this could enable uploading and potentially executing malicious files, enabli...

PT-2025-9840 · Redaxo · Redaxo

Name of the Vulnerable Software and Affected Versions: REDAXO versions 5.0.0 through 5.18.2 Description: The issue concerns a Reflected cross-site scripting XSS vulnerability in the rex-api-result parameter on the AddOns page. Recommendations: For versions 5.0.0 through 5.18.2, update to version...

PT-2025-9839 · Redaxo · Redaxo

Name of the Vulnerable Software and Affected Versions: Redaxo versions prior to 5.18.3 Description: The issue concerns arbitrary file upload in the mediapool/media page of the Redaxo CMS. This vulnerability has been fixed in version 5.18.3. Recommendations: For versions prior to 5.18.3, update to...

REDAXO 跨站脚本漏洞

REDAXO is a content management system of REDAXO open source. A cross-site scripting vulnerability exists in REDAXO versions 5.0.0 through 5.18.2, which stems from susceptibility to reflective cross-site scripting attacks...

REDAXO 代码问题漏洞

REDAXO is a content management system from REDAXO open source. A code issue vulnerability exists in REDAXO versions prior to 5.18.3 that stems from allowing arbitrary file uploads...

Cross-Site Scripting (XSS)

redaxo/source is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper handling of the "Article Name" argument in the Structure Management Page, allowing remote attackers to inject malicious scripts...

GHSA-7WJ8-856P-QC9M Stored XSS in REDAXO

Summary Stored XSS in REDAXO 5.18.1 - Article / "content/edit". Details On the latest version of Redaxo, v5.18.1, the article name field is susceptible to stored XSS. Impact A malicious actor can easily steal cookie using this stored XSS and perform a session hijacking attack...

Stored XSS in REDAXO

Summary Stored XSS in REDAXO 5.18.1 - Article / "content/edit". Details On the latest version of Redaxo, v5.18.1, the article name field is susceptible to stored XSS. Impact A malicious actor can easily steal cookie using this stored XSS and perform a session hijacking attack...

Stored Cross-site Scripting (XSS)

redaxo/source is vulnerable to Stored cross-site scripting XSS. The vulnerability is due to improper input validation in the /media/test.html component, allowing attackers to inject malicious scripts into the password parameter...

CVE-2024-46210

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-46210

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file...

PT-2025-2732 · Unknown · Redaxo Cms

Name of the Vulnerable Software and Affected Versions: Redaxo CMS version 5.17.1 Description: An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS allows attackers to execute arbitrary code via uploading a crafted file. Recommendations: For Redaxo CMS version 5.17.1,...

REDAXO 安全漏洞

REDAXO is a content management system from REDAXO open source. A security vulnerability exists in REDAXO v5.17.1, which originates from an arbitrary file upload in the MediaPool module, allowing an attacker to execute arbitrary code by uploading a crafted file...

CVE-2024-46210

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file...