Skip to content
Redaxo vulnerabilities
Newest
-
opnsense core
REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
CVE-2026-117536
8.6 High
-
opnsense core
REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
CVE-2026-117535
5.1 Medium
-
opnsense core
REDAXO before 5.21.3 CSRF in Article History Plugin
CVE-2026-117534
5.1 Medium
-
opnsense core
REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
CVE-2026-117533
2.1 Low
-
opnsense core
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
CVE-2026-117532
Public exploit
9.3 Critical
-
opnsense core
REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets
CVE-2026-116900
5.1 Medium
-
opnsense core
REDAXO before 5.21.4 Broken Access Control in Slice Operations
CVE-2026-116899
7.1 High
-
opnsense core
REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
CVE-2026-116898
7.1 High
-
opnsense core
REDAXO before 5.21.4 Missing Authorization in Version and History Previews
CVE-2026-116897
7.1 High
-
opnsense core
REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
CVE-2026-116896
7.7 High
-
opnsense core
REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
CVE-2026-116895
5.1 Medium
-
opnsense core
REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
CVE-2026-116894
2.3 Low
-
opnsense core
REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
CVE-2026-116893
6.1 Medium
-
redaxo, opnsense core +1 more
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
CVE-2026-63000
Fix available
6.4 Medium
-
opnsense core, redaxo +1 more
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
CVE-2026-62998
Fix available
4.3 Medium
-
redaxo, opnsense core +1 more
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
CVE-2026-63002
Fix available
4.8 Medium
-
redaxo, opnsense core +1 more
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
CVE-2026-63001
Fix available
4.8 Medium
-
opnsense core
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
CVE-2026-53599
Fix available
7.5 High
-
redaxo cms mediapool
Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload
CVE-2018-25353
8.7 High
-
opnsense core
REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter
CVE-2026-117538
Fix available
2.1 Low
-
opnsense core
REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter
CVE-2026-117537
Fix available
2.1 Low
-
redaxo, redaxo cms +1 more
Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint
CVE-2016-20053
6.9 Medium
-
redaxo
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
CVE-2026-21857
Public exploitFix available
8.3 High
-
redaxo
REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
CVE-2025-66026
Fix available
6.1 Medium
-
redaxo
REDAXO CMS is vulnerable to RCE attack through its template management component
CVE-2025-64050
Fix available
7.2 High
-
redaxo
REDAXO CMS is vulnerable to XSS through its module management component
CVE-2025-64049
Fix available
4.8 Medium
-
redaxo
REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation
CVE-2025-27412
Fix available
6.1 Medium
-
redaxo
REDAXO allows Arbitrary File Upload in the mediapool page
CVE-2025-27411
Fix available
5.4 Medium
-
redaxo
An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows...
CVE-2024-46210
7.2 High
-
redaxo cms, redaxo +1 more
Redaxo CMS Structure Management Page index.php cross site scripting
CVE-2024-13209
Fix available
5.1 Medium
-
redaxo
REDAXO CMS Cross-site Scripting vulnerability
CVE-2024-46209
Public exploit
5.4 Medium
-
redaxo
Redaxo Core CMS Cross Site Scripting (XSS)
CVE-2024-50803
Public exploitFix available
6.1 Medium
-
redaxo
REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.
CVE-2024-46213
7.2 High
-
redaxo
Path traversal in redaxo
CVE-2024-46212
4.9 Medium
-
redaxo
Code injection in REDAXO
CVE-2024-25298
7.2 High
-
redaxo
Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the...
CVE-2024-25301
7.2 High
-
redaxo
A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute...
CVE-2024-25300
4.8 Medium
-
redaxo
Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows...
CVE-2021-39459
7.2 High
-
redaxo
Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows...
CVE-2021-39458
6.5 Medium
-
redaxo
There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.
CVE-2018-18200
9.8 Critical
-
redaxo
Mediamanager in REDAXO before 5.6.4 has XSS.
CVE-2018-18199
6.1 Medium
-
redaxo
The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not...
CVE-2018-18198
6.1 Medium
-
redaxo
In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the...
CVE-2018-17831
9.8 Critical
-
redaxo
The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively...
CVE-2018-17830
5.4 Medium
-
redaxo cms
An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an...
CVE-2018-15850
8.8 High
-
redaxo
Cross-site scripting (XSS) vulnerability in include/classes/class.rex_list.inc.php in REDAXO 4.3...
CVE-2012-3869
4.3 Medium
-
redaxo
PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to...
CVE-2006-2845
Public exploit
7.5 High
-
redaxo
Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to...
CVE-2006-2844
Public exploit
7.5 High
-
redaxo
PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute...
CVE-2006-2843
Public exploit
7.5 High