Advisories · Technology
redaxo core.
Every CVE that names redaxo core among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 8.6 High
REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
- redaxo core
- Cross-site request forgery (CSRF)
- CVSS 5.1 Medium
REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
- redaxo core
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
REDAXO before 5.21.3 CSRF in Article History Plugin
- redaxo core
- Cross-site request forgery (CSRF)
- CVSS 2.1 Low
REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
- redaxo core
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
- redaxo core
- Authentication bypass
- CVSS 5.1 Medium
REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets
- redaxo core
- Cross-site scripting (XSS)
- CVSS 7.1 High
REDAXO before 5.21.4 Broken Access Control in Slice Operations
- redaxo core
- Broken access control
- CVSS 7.1 High
REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
- redaxo core
- Broken access control
- CVSS 7.1 High
REDAXO before 5.21.4 Missing Authorization in Version and History Previews
- redaxo core
- Broken access control
- CVSS 7.7 High
REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
- redaxo core
- Broken access control
- CVSS 5.1 Medium
REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
- redaxo core
- Cross-site request forgery (CSRF)
- CVSS 2.3 Low
REDAXO before 5.21.5 Insufficient Session Expiration on Password Change
- redaxo core
- Authentication bypass
- CVSS 6.1 Medium
REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
- redaxo core
- Broken access control