CVE-2025-64049
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding a slice that uses the compromised module.
Risk Assessment
An attacker can execute arbitrary JavaScript in REDAXO users' browsers, potentially leading to session theft, account takeover, or content modification. This affects CMS integrity and confidentiality.
Recommendation
Update REDAXO CMS to a patched version. Restrict module editing permissions to trusted users and implement input validation.
Other vulnerabilities in REDAXO CMS
See all- CVE-2016-20053Medium
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.
- CVE-2025-64050High
A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload executes when visitors access frontend pages using the compromised template.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS