Security
فارسی
All products

redaxo/source

Composer · Package
18 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)CVE-2026-117537 · GHSA-M662-8JRJ-CW6V redaxo/source Composer Low Fix reported
REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)CVE-2026-117538 · GHSA-XQ4J-G85Q-WF97 redaxo/source Composer Low Fix reported
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column EnumerationCVE-2026-62998 · GHSA-4F5F-J737-PM58 redaxo/source Composer Medium Fix reported
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon UpdatesCVE-2026-63000 · GHSA-M8R3-22V6-G877 redaxo/source Composer Medium Fix reported
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem FilenamesCVE-2026-63002 · GHSA-W998-QMW9-MF4M redaxo/source Composer Medium Fix reported
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`CVE-2026-63001 · GHSA-MF2P-WJP4-99PQ redaxo/source Composer Medium Fix reported
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlersCVE-2026-53599 · GHSA-98PP-VCCM-QM25 redaxo/source Composer High Fix reported
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File ReadCVE-2026-21857 · GHSA-824X-88XG-CWRV redaxo/source Composer High Fix reported
REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]CVE-2025-66026 · GHSA-X6VR-Q3VF-VQGQ redaxo/source Composer Medium Fix reported
REDAXO CMS is vulnerable to XSS through its module management componentCVE-2025-64049 · GHSA-VQC7-7FJ4-3FM3 redaxo/source Composer Medium Fix reported
REDAXO CMS is vulnerable to RCE attack through its template management componentCVE-2025-64050 · GHSA-XJ9J-GJXG-7JVQ redaxo/source Composer High Fix reported
Redaxo Core CMS Cross Site Scripting (XSS)CVE-2024-50803 · GHSA-M5VV-7JXC-8P6X redaxo/source Composer Medium Fix reported
REDAXO allows Arbitrary File Upload in the mediapool pageCVE-2025-27411 · GHSA-WPPF-GQJ5-FC4F redaxo/source Composer Medium Fix reported
REDAXO allows Authenticated Reflected Cross Site Scripting - packages installationCVE-2025-27412 · GHSA-8366-XMGF-334F redaxo/source Composer Medium Fix reported
Stored XSS in REDAXOCVE-2024-13209 · GHSA-7WJ8-856P-QC9M redaxo/source Composer Medium Fix reported
REDAXO CMS Cross-site Scripting vulnerabilityCVE-2024-46209 · GHSA-2P95-8XVM-2PJX redaxo/source Composer Low No fix reported
Path traversal in redaxoCVE-2024-46212 · GHSA-37GM-H5WR-PF25 redaxo/source Composer Medium No fix reported
Code injection in REDAXOCVE-2024-25298 · GHSA-7F2V-5877-RX3X redaxo/source Composer High No fix reported