Product by Redaxo

    Core

    20 known vulnerabilities in Core (Redaxo), 0 of them actively exploited (CISA KEV).

    Key figures

    20

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Core (Redaxo)
    CriticalCVE-2026-117532

    REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

    		9.8
    HighCVE-2026-53599

    Redaxo Core: Unrestricted Upload of File with Dangerous Type

    		7.5
    HighCVE-2026-117536

    REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation

    		8.8
    HighCVE-2026-116896

    REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables

    		7.5
    HighCVE-2026-116897

    REDAXO before 5.21.4 Missing Authorization in Version and History Previews

    		6.5
    MediumCVE-2026-116893

    REDAXO core before 5.21.5 Missing Authorization in rex_api_package API

    		6.8
    HighCVE-2026-116899

    REDAXO before 5.21.4 Broken Access Control in Slice Operations

    		6.5
    HighCVE-2026-116898

    REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move

    		7.1
    MediumCVE-2026-117535

    REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool

    		6.1
    MediumCVE-2026-63000

    REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

    also in 1 other product

    		6.4
    MediumCVE-2026-62998

    REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

    also in 1 other product

    		4.3
    MediumCVE-2026-116900

    REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets

    		5.4
    MediumCVE-2026-117534

    REDAXO before 5.21.3 CSRF in Article History Plugin

    		5.4
    MediumCVE-2026-116895

    REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter

    		5.4
    MediumCVE-2026-63002

    REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

    also in 1 other product

    		4.8
    MediumCVE-2026-63001

    REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

    also in 1 other product

    		4.8
    MediumCVE-2026-117533

    REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads

    		4.4
    MediumCVE-2026-116894

    REDAXO before 5.21.5 Insufficient Session Expiration on Password Change

    		4.2
    MediumCVE-2026-117538

    REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

    		4.1
    MediumCVE-2026-117537

    REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

    		4.1

    All products by Redaxo