Executive brief
REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
Affected products
- Packagist redaxo/source
Junglewise Threat Intelligence
CVE-2025-66026: REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
CVE-2025-66026 · Severity: low · CVSS 3.1 · Published 2025-11-25
Technologies: redaxo/source (Packagist). Vendors: Packagist.
Related threats
- REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diff
- REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_ma
- REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_pa
- REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort
- REDAXO CMS authenticated RCE via multi-extension upload bypass