Browse all 12 CVE security advisories affecting Redaxo. AI-powered Chinese analysis, POCs, and references for each vulnerability.
Redaxo is a flexible content management system designed for building websites and applications. Historically, it has been susceptible to various vulnerabilities including remote code execution, cross-site scripting, and privilege escalation, with six CVEs documented. The platform's modular architecture introduces potential risks through third-party extensions. While no major security incidents have been widely reported, the consistent discovery of vulnerabilities in core components and plugins indicates ongoing security challenges. Users should implement strict input validation and keep systems updated to mitigate risks associated with this CMS.
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-63000 | REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates — core CWE-352 | 6.4 | Medium | 2026-09-23 |
| CVE-2026-62998 | REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration — core CWE-20 | 4.3 | Medium | 2026-09-23 |
| CVE-2026-63002 | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames — core CWE-79 | 4.8 | Medium | 2026-09-23 |
| CVE-2026-63001 | REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` — core CWE-79 | 4.8 | Medium | 2026-09-23 |
| CVE-2026-53599 | Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers — core CWE-434 | 7.5 | High | 2026-07-31 |
This page lists every published CVE security advisory associated with Redaxo. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.