Filtered by vendor Redaxo Subscriptions
Filtered by product Redaxo Subscriptions
Total 16 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-25301 1 Redaxo 1 Redaxo 2024-11-21 7.2 High
Redaxo v5.15.1 was discovered to contain a remote code execution (RCE) vulnerability via the component /pages/templates.php.
CVE-2024-25300 1 Redaxo 1 Redaxo 2024-11-21 4.8 Medium
A cross-site scripting (XSS) vulnerability in Redaxo v5.15.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter in the Template section.
CVE-2024-25298 1 Redaxo 1 Redaxo 2024-11-21 7.2 High
An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.
CVE-2021-39459 1 Redaxo 1 Redaxo 2024-11-21 7.2 High
Remote code execution in the modules component in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user to execute code on the hosting system via a module containing malicious PHP code.
CVE-2021-39458 1 Redaxo 1 Redaxo 2024-11-21 6.5 Medium
Triggering an error page of the import process in Yakamara Media Redaxo CMS version 5.12.1 allows an authenticated CMS user has to alternate the files of a vaild file backup. This leads of leaking the database credentials in the environment variables.
CVE-2018-18200 1 Redaxo 1 Redaxo 2024-11-21 N/A
There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.
CVE-2018-18199 1 Redaxo 1 Redaxo 2024-11-21 N/A
Mediamanager in REDAXO before 5.6.4 has XSS.
CVE-2018-18198 1 Redaxo 1 Redaxo 2024-11-21 N/A
The $opener_input_field variable in addons/mediapool/pages/index.php in REDAXO 5.6.3 is not effectively filtered and is output directly to the page. The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=[XSS] request.
CVE-2018-17831 1 Redaxo 1 Redaxo 2024-11-21 N/A
In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the prepareQuery function in core/lib/list.php, via the index.php?page=users/users sort parameter. Endangered was the backend and the frontend only if rex_list were used.
CVE-2018-17830 1 Redaxo 1 Redaxo 2024-11-21 N/A
The $args variable in addons/mediapool/pages/index.php in REDAXO 5.6.2 is not effectively filtered, because names are not restricted (only values are restricted). The attacker can insert XSS payloads via an index.php?page=mediapool/media&opener_input_field=&args[ substring.
CVE-2012-3869 1 Redaxo 1 Redaxo 2024-11-21 N/A
Cross-site scripting (XSS) vulnerability in include/classes/class.rex_list.inc.php in REDAXO 4.3.x and 4.4 allows remote attackers to inject arbitrary web script or HTML via the subpage parameter to index.php.
CVE-2006-2845 1 Redaxo 1 Redaxo 2024-11-21 N/A
PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to image_resize/pages/index.inc.php.
CVE-2006-2844 1 Redaxo 1 Redaxo 2024-11-21 N/A
Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[INCLUDE_PATH] parameter to (1) simple_user/pages/index.inc.php and (2) stats/pages/index.inc.php.
CVE-2006-2843 1 Redaxo 1 Redaxo 2024-11-21 N/A
PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL in the (1) REX[INCLUDE_PATH] parameter in (a) addons/import_export/pages/index.inc.php and (b) pages/community.inc.php.
CVE-2024-46213 1 Redaxo 1 Redaxo 2024-10-18 7.2 High
REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.
CVE-2024-46212 1 Redaxo 1 Redaxo 2024-10-18 4.9 Medium
An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.