Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Redaxo — Vulnerabilities & Security Advisories 12

Browse all 12 CVE security advisories affecting Redaxo. AI-powered Chinese analysis, POCs, and references for each vulnerability.

Redaxo is a flexible content management system designed for building websites and applications. Historically, it has been susceptible to various vulnerabilities including remote code execution, cross-site scripting, and privilege escalation, with six CVEs documented. The platform's modular architecture introduces potential risks through third-party extensions. While no major security incidents have been widely reported, the consistent discovery of vulnerabilities in core components and plugins indicates ongoing security challenges. Users should implement strict input validation and keep systems updated to mitigate risks associated with this CMS.

CVE ID Title CVSS Severity Published
CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates — core CWE-352 6.4 Medium 2026-09-23
CVE-2026-62998 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration — core CWE-20 4.3 Medium 2026-09-23
CVE-2026-63002 REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames — core CWE-79 4.8 Medium 2026-09-23
CVE-2026-63001 REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` — core CWE-79 4.8 Medium 2026-09-23
CVE-2026-53599 Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers — core CWE-434 7.5 High 2026-07-31
CVE-2018-25353 Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload — Redaxo CMS Mediapool CWE-863 8.8 High 2026-05-23
CVE-2016-20053 Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint — Redaxo CMS CWE-352 5.3 Medium 2026-04-04
CVE-2026-21857 Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read — redaxo CWE-24 6.5 - 2026-01-07
CVE-2025-66026 REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types] — redaxo CWE-79 6.1 Medium 2025-11-26
CVE-2025-27412 REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation — redaxo CWE-79 6.1 Medium 2025-03-05
CVE-2025-27411 REDAXO allows Arbitrary File Upload in the mediapool page — redaxo CWE-434 5.4 Medium 2025-03-05
CVE-2024-13209 Redaxo CMS Structure Management Page index.php cross site scripting — CMS CWE-79 2.4 Low 2025-01-09

This page lists every published CVE security advisory associated with Redaxo. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.