GitHub Advisoryadvisory · Packagist

GHSA-vqc7-7fj4-3fm3 REDAXO CMS is vulnerable to XSS through its module management component

MEDIUM Published 2025-11-25 Modified 2025-11-26 Official page ↗
Aliases
CVE-2025-64049
Ecosystem
Packagist
Packages
redaxo/source
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-79
Reviewed
2025-11-26

Affected packages

• Packagist redaxo/source: < 5.20.1 → fixed in 5.20.1

Description

A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.

Related

Alias · CVE (1)

  • CVE-2025-64049 A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References