What’s Vulnerable › Products

redaxo core vulnerabilities

16 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 16 published in the last 12 months.

Check whether your redaxo core version is affected

Latest redaxo core vulnerabilities

• CVE-2026-117538 — REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter (CVSS 4.1)
• CVE-2026-117537 — REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter (CVSS 4.1)
• CVE-2026-117536 — REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation (CVSS 8.8)
• CVE-2026-117535 — REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool (CVSS 6.1)
• CVE-2026-117534 — REDAXO before 5.21.3 CSRF in Article History Plugin (CVSS 5.4)
• CVE-2026-117533 — REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads (CVSS 4.4)
• CVE-2026-117532 — REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin (CVSS 9.8)
• CVE-2026-116900 — REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets (CVSS 5.4)
• CVE-2026-116899 — REDAXO before 5.21.4 Broken Access Control in Slice Operations (CVSS 6.5)
• CVE-2026-116898 — REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move (CVSS 7.1)
• CVE-2026-116897 — REDAXO before 5.21.4 Missing Authorization in Version and History Previews (CVSS 6.5)
• CVE-2026-116896 — REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables (CVSS 7.5)
• CVE-2026-116895 — REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter (CVSS 5.4)
• CVE-2026-116894 — REDAXO before 5.21.5 Insufficient Session Expiration on Password Change (CVSS 4.2)
• CVE-2026-116893 — REDAXO core before 5.21.5 Missing Authorization in rex_api_package API (CVSS 6.8)
• CVE-2026-53599 — Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers (CVSS 7.5)