Redaxo vulnerabilities

CVEs per yearBy the year they were published

1. 20254
2. 202623

Newest CVEs

• CVE-2026-117538

  REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

  redaxo · core

  Low2.1
• CVE-2026-117537

  REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

  redaxo · core

  Low2.1
• CVE-2026-117536

  REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation

  redaxo · core

  High8.6
• CVE-2026-117535

  REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool

  redaxo · core

  Medium5.1
• CVE-2026-117534

  REDAXO before 5.21.3 CSRF in Article History Plugin

  redaxo · core

  Medium5.1
• CVE-2026-117533

  REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads

  redaxo · core

  Low2.1
• CVE-2026-117532

  REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

  redaxo · core

  Critical9.3
• CVE-2026-116900

  REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets

  redaxo · core

  Medium5.1
• CVE-2026-116899

  REDAXO before 5.21.4 Broken Access Control in Slice Operations

  redaxo · core

  High7.1
• CVE-2026-116898

  REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move

  redaxo · core

  High7.1