redaxo/source vulnerabilities (Packagist)
18 vulnerabilities.
-
redaxo/sourcePackagist REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates 6.4 Medium -
redaxo/sourcePackagist REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration 4.3 Medium -
redaxo/sourcePackagist REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames 4.8 Medium -
redaxo/sourcePackagist REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` 4.8 Medium -
redaxo/sourcePackagist Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers 7.5 High -
redaxo/sourcePackagist REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter 2.1 Low -
redaxo/sourcePackagist REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter 2.1 Low -
redaxo/sourcePackagist Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read 8.3 High -
redaxo/sourcePackagist REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types] 6.1 Medium -
redaxo/sourcePackagist REDAXO CMS is vulnerable to RCE attack through its template management component 7.2 High -
redaxo/sourcePackagist REDAXO CMS is vulnerable to XSS through its module management component 4.8 Medium -
redaxo/sourcePackagist REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation 6.1 Medium -
redaxo/sourcePackagist REDAXO allows Arbitrary File Upload in the mediapool page 5.4 Medium -
redaxo/sourcePackagist Redaxo CMS Structure Management Page index.php cross site scripting 5.1 Medium -
redaxo/sourcePackagist REDAXO CMS Cross-site Scripting vulnerability 5.4 Medium -
redaxo/sourcePackagist Redaxo Core CMS Cross Site Scripting (XSS) 6.1 Medium -
redaxo/sourcePackagist Path traversal in redaxo 4.9 Medium -
redaxo/sourcePackagist Code injection in REDAXO 7.2 High