Redaxo is a content management system that, despite a narrow product footprint, commands attention within its deployment domain and carries a durable vulnerability profile centered on its web-facing platform. Vulnerabilities affecting the vendor lean toward serious outcomes, with a meaningful share reaching critical severity; additionally, the exposure has an elevated tendency to acquire public exploit tooling. The recurring weakness classes—principally cross-site scripting, code injection, path traversal, and cross-site request forgery—reflect the parser and input-handling demands endemic to web-based content management and administration interfaces. Defenders managing Redaxo instances should prioritize patching the CMS itself and securing administrative access; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Redaxo over time
Signals from CVEs in this vendor scope (28 CVEs).
28 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-18200CRITICAL There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4. | Oct 9, 2018 | 9.8 | 31 | NO | NO |
CVE-2018-17831CRITICAL In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the index.ph | Oct 1, 2018 | 9.8 | 31 | NO | NO |
CVE-2006-2843HIGH PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the (1) REX[INCLUDE_PATH] parameter in (a) addons/import_ | Jun 6, 2006 | 7.5 | 29 | NO | YES |
CVE-2006-2844HIGH Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to (1) simple_use | Jun 6, 2006 | 7.5 | 29 | NO | YES |
CVE-2006-2845HIGH PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to image_resize/p | Jun 6, 2006 | 7.5 | 29 | NO | YES |
CVE-2018-15850HIGH An issue was discovered in REDAXO CMS 4.7.2. There is a CSRF vulnerability that can add an administrator account via index.php?page=user. | Aug 25, 2018 | 8.8 | 27 | NO | NO |
CVE-2025-64050HIGH A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating syst | Nov 25, 2025 | 7.2 | 25 | NO | NO |
CVE-2021-39459HIGH Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting system via a module conta | Sep 9, 2021 | 7.2 | 25 | NO | NO |
CVE-2016-20053MEDIUM Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administra | Apr 4, 2026 | 6.5 | 24 | NO | NO |
CVE-2025-66026MEDIUM REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is ren | Nov 26, 2025 | 6.1 | 22 | NO | NO |
Signals from CVEs in this vendor scope (28 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Redaxo.
Media articles that mention a CVE ID that affects a product developed by Redaxo — matched by CVE ID, not by vendor name.