CVE-2025-64049

Published: Nov 25, 2025Modified: Jun 17, 2026

4.8

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Exploitability: 1.7 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.

Affected (1)

Products: Redaxo: Redaxo

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redaxo Redaxo	Version 5.20.0

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://drive.google.com/drive/folders/1SpwL548ZBRYU_uL8W7Riv7VHshr2UN0R?usp=sharing

Source: cve@mitre.org

Exploit

https://github.com/redaxo/redaxo

Source: cve@mitre.org

Product

https://github.com/vettrivel007/CVE-Disclosures/blob/main/CVE-2025-64049.md

Source: cve@mitre.org

ExploitMitigationThird Party Advisory

Timeline

No history available yet.