CVE-2026-21857

CVE-2026-21857: Redaxo tiene un Path Traversal en el addon de Backup que conduce a la lectura arbitraria de archivos Información general Campo| Detalles ---|--- ID de CVE| CVE-2026-21857 Gravedad| ALTA Aviso| Ver aviso Descubierto por| Lukasz Rybak Productos afectados redaxo/source versiones: =...

CVE-2024-50803-Redaxo

CVE-2024-50803 XSS almacenado en la función mediapool de Redaxo Se encontró una vulnerabilidad de cross-site scripting XSS almacenado en las versiones de Redaxo 5.18.0, que permite a atacantes con privilegios suficientes subir un archivo SVG malicioso a través de la función mediapool. Publicado u...

CVE-2024-46209

Redaxo Security Research CVE-2024-46209, CVE-2024-46210 Investigación de seguridad de Redaxo CMS v5.17.1 Completado el 09 de agosto de 2024 Contiene una descripción detallada de: CVE-2024-46210 - Cross-Site Scripting almacenado a través de la carga de archivos en el módulo MediaPool CVE-2024-4620...

EUVD-2026-85332

REDAXO: Unwhitelisted ORDER BY Column in rexlist Allows Authenticated Column Enumeration...

REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

Summary The rexlist component reads the SQL sort column directly from the sort GET parameter without validating it against the set of columns declared sortable via setColumnSortable. Although the value is wrapped in backticks via escapeIdentifier preventing classical SQL injection, this still...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the getSortColumn process. An attacker can access sensitive database column names and manipulate the ordering of query results by supplying arbitrary values to the sort parameter, which are not validated against...

GHSA-4F5F-J737-PM58 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

Summary The rexlist component reads the SQL sort column directly from the sort GET parameter without validating it against the set of columns declared sortable via setColumnSortable. Although the value is wrapped in backticks via escapeIdentifier preventing classical SQL injection, this still...

CVE-2026-63001

creationtimestamp| type| source ---|---|--- 2026-09-23 16:35:08+00:00| published-proof-of-concept| https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq...

CVE-2026-63002

creationtimestamp| type| source ---|---|--- 2026-09-23 16:35:06+00:00| published-proof-of-concept| https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m...

CVE-2026-63000

creationtimestamp| type| source ---|---|--- 2026-09-23 16:35:04+00:00| published-proof-of-concept| https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877 2026-09-23 18:31:57+00:00| seen| https://gist.github.com/alon710/c6373b33ac6c019650400085845933ec...

CVE-2026-63001

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse handler in redaxo/src/addons/mediamanager/lib/mediamanager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIAISINUSE. An administrator with Media...

CVE-2026-62998

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

CVE-2026-63002

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

CVE-2026-63000

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the rexapiinstallpackageupdate process. An attacker can trigger unauthorized addon updates by luring an authenticated admin to visit a malicious page, causing unintended package updates or downgrades t...

GHSA-M8R3-22V6-G877 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

Summary The rexapiinstallpackageupdate API function install addon does not override requiresCsrfProtection, which defaults to false in the base class rexapifunction. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO packag...

REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

Summary The rexapiinstallpackageupdate API function install addon does not override requiresCsrfProtection, which defaults to false in the base class rexapifunction. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO packag...

CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...