CVE-2025-64049
Medium · 4.8REDAXO CMS is vulnerable to XSS through its module management component
CVSS
4.8
EPSS
0.3%
Published
Nov 25, 2025
CISA due date
—
The record
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | redaxo/source | 0 | 5.20.1 |
Related vulnerabilities
- GHSA-vqc7-7fj4-3fm3 REDAXO CMS is vulnerable to XSS through its module management component Same vulnerability
- GHSA-824x-88xg-cwrv Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Also affects redaxo/source
- CVE-2026-21857 Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Also affects redaxo/source
- GHSA-x6vr-q3vf-vqgq REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types] Also affects redaxo/source
- GHSA-xj9j-gjxg-7jvq REDAXO CMS is vulnerable to RCE attack through its template management component Also affects redaxo/source
- CVE-2025-64050 REDAXO CMS is vulnerable to RCE attack through its template management component Also affects redaxo/source
- CVE-2025-66026 REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types] Also affects redaxo/source
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79