Redaxo

redaxo

32 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (32)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2021-39459 1Redaxo 1Redaxo Jun 17, 2026 Sep 9, 2021 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting system via a module containing malicious PHP code.
CVE-2021-39458 1Redaxo 1Redaxo Jun 17, 2026 Sep 9, 2021 N/A· v4 6.5 MEDIUM· v3 4.0 MEDIUM· v2 Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup. This leads of leaking the database credential...Show more Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup. This leads of leaking the database credentials in the environment variables.Show less
CVE-2018-18200 1Redaxo 1Redaxo Nov 21, 2024 Oct 9, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.
CVE-2018-18199 1Redaxo 1Redaxo Nov 21, 2024 Oct 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 Mediamanager in REDAXO before 5.6.4 has XSS.
CVE-2018-18198 1Redaxo 1Redaxo Nov 21, 2024 Oct 9, 2018 N/A· v4 6.1 MEDIUM· v3 4.3 MEDIUM· v2 The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/me...Show more The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=[XSS] request.Show less
CVE-2018-17831 1Redaxo 1Redaxo Nov 21, 2024 Oct 1, 2018 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endan...Show more In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rex_list were used.Show less
CVE-2018-17830 1Redaxo 1Redaxo Nov 21, 2024 Oct 1, 2018 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricted). The attacker can insert XSS payloads via an index.php?pag...Show more The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricted). The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=&args[ substring.Show less
CVE-2018-15850 1Redaxo 1Redaxo Cms Nov 21, 2024 Aug 25, 2018 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user.
CVE-2012-3869 1Redaxo 1Redaxo Apr 29, 2026 Aug 13, 2012 N/A· v4 N/A· v3 4.3 MEDIUM· v2 Cross-site scripting (XSS) vulnerability in include/classes/class.rex_list.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the subpage parameter to index.php.
CVE-2006-2845 1Redaxo 1Redaxo Apr 16, 2026 Jun 6, 2006 N/A· v4 N/A· v3 7.5 HIGH· v2 PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to image_resize/pages/index.inc.php.
CVE-2006-2844 1Redaxo 1Redaxo Apr 16, 2026 Jun 6, 2006 N/A· v4 N/A· v3 7.5 HIGH· v2 Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to (1) simple_user/pages/index.inc.php and (2) stats/page...Show more Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to (1) simple_user/pages/index.inc.php and (2) stats/pages/index.inc.php.Show less
CVE-2006-2843 1Redaxo 1Redaxo Apr 16, 2026 Jun 6, 2006 N/A· v4 N/A· v3 7.5 HIGH· v2 PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the (1) REX[INCLUDE_PATH] parameter in (a) addons/import_export/pages/index.inc.php and (b) pages...Show more PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the (1) REX[INCLUDE_PATH] parameter in (a) addons/import_export/pages/index.inc.php and (b) pages/community.inc.php.Show less