Medium
CVE-2026-62998
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 18
Reset filters
Medium
CVE-2026-63000
REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
Medium
CVE-2026-63002
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
Medium
CVE-2026-63001
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
High
CVE-2026-53599
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
Low
ghsa-xq4j-g85q-wf97
REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)
Low
ghsa-m662-8jrj-cw6v
REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)
High
CVE-2026-21857
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
Medium
CVE-2025-66026
REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
Medium
CVE-2025-64049
REDAXO CMS is vulnerable to XSS through its module management component
High
CVE-2025-64050
REDAXO CMS is vulnerable to RCE attack through its template management component
Medium
CVE-2025-27412
REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation
Medium
CVE-2025-27411
REDAXO allows Arbitrary File Upload in the mediapool page
Medium
CVE-2024-13209
Stored XSS in REDAXO
Low
CVE-2024-46209
REDAXO CMS Cross-site Scripting vulnerability
Medium
CVE-2024-50803
Redaxo Core CMS Cross Site Scripting (XSS)
Medium
CVE-2024-46212
Path traversal in redaxo
High
CVE-2024-25298
Code injection in REDAXO
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.