CVE-2025-27412

REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation PUBLISHED

Description (CNA)

REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting (XSS) on the page of AddOns. This vulnerability is fixed in 5.18.3.

Affected (CNA)

Vendor / product	Versions
redaxo / redaxo	affected >= 5.0.0, < 5.18.3

CWE

CWE-79

References

https://github.com/redaxo/redaxo/security/advisories/GHSA-8366-xmgf-334f

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.