redaxo vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-117536 REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check onlyHigh 8.6 · Oct 27, 2026
• CVE-2026-117532 REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to foCritical 9.3 · Oct 27, 2026
• CVE-2026-116899 REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a pHigh 7.1 · Oct 27, 2026
• CVE-2026-116898 REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the sourceHigh 7.1 · Oct 27, 2026
• CVE-2026-116897 REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not cheHigh 7.1 · Oct 27, 2026
• CVE-2026-116896 REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with thHigh 7.7 · Oct 27, 2026
• CVE-2026-53599 REDAXO is a PHP-based content management system.High 7.5 · Jul 31, 2026
• CVE-2018-25353 Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file extension blacklist reHigh 8.7 · May 23, 2026
• CVE-2026-21857 REDAXO is a PHP-based content management system.High 8.3 · Jan 7, 2026
• CVE-2025-64050 A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbiHigh 7.2 · Nov 25, 2025
• CVE-2024-46210 An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file.High 7.2 · Jan 10, 2025
• CVE-2024-46213 REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.High 7.2 · Oct 16, 2024
• CVE-2024-25298 An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.High 7.2 · Feb 17, 2024
• CVE-2024-25301 Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.High 7.2 · Feb 14, 2024
• CVE-2021-39459 Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting systeHigh 7.2 · Sep 9, 2021
• CVE-2018-18200 There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.Critical 9.8 · Oct 9, 2018
• CVE-2018-17831 In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.pCritical 9.8 · Oct 1, 2018
• CVE-2018-15850 An issue was discovered in REDAXO CMS 4.7.2.High 8.8 · Aug 25, 2018
• CVE-2006-2843 PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the (1) REX[INCLUDE_PATH] parameter iHigh 7.5 · Jun 6, 2006
• CVE-2006-2844 Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parametHigh 7.5 · Jun 6, 2006
• CVE-2006-2845 PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parametHigh 7.5 · Jun 6, 2006