Redaxo/source

This hub aggregates every CVE we track for Redaxo/source, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 11 most recently published vulnerabilities affecting Redaxo/source.

• CVE-2026-21857Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read6.5Jan 7, 2026
• CVE-2025-66026REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]6.1Nov 26, 2025
• CVE-2025-64049A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in mod...4.8Nov 25, 2025
• CVE-2025-64050A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by in...7.2Nov 25, 2025
• CVE-2025-27412REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation6.1Mar 5, 2025
• CVE-2025-27411REDAXO allows Arbitrary File Upload in the mediapool page5.4Mar 5, 2025
• CVE-2024-13209Redaxo CMS Structure Management Page index.php cross site scripting2.4Jan 9, 2025
• CVE-2024-46209A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload i...5.4Jan 6, 2025
• CVE-2024-50803The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges5.4Nov 19, 2024
• CVE-2024-46212An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.4.9Oct 16, 2024
• CVE-2024-25298An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.7.2Feb 17, 2024