REDAXO CMS is vulnerable to XSS through its module management component
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2025-64049US | — | — | ||
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output… | ||||
02
references
External citations — patches, advisories, analysis.
- https://drive.google.com/drive/folders/1SpwL548ZBRYU_uL8W7Riv7VHshr2UN0R?usp=sharingWEB
- https://github.com/redaxo/redaxoPACKAGE
- https://github.com/redaxo/redaxo/commit/58929062312cf03e344ab04067a365e6b6ee66aaWEB
- https://github.com/vettrivel007/CVE-Disclosures/blob/main/CVE-2025-64049.mdWEB
- https://nvd.nist.gov/vuln/detail/CVE-2025-64049ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan