HIGH🇬🇧 English

CVE-2025-64050

CVSS 7.2v3.1pub. 2025-11-25upd. 2025-12-03

A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.

oryginał EN
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

  • Redaxo

    APP
    Redaxo
    5.20.0
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCE
CWE
Referencje

Powiązane podatności

CVE-2018-18200CRITICAL9.8ten sam produkt

There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.

CVE-2018-17831CRITICAL9.8ten sam produkt

In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class becau...

CVE-2026-21857HIGH8.3ten sam produkt

REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup perm...

CVE-2024-46210HIGH7.2ten sam produkt

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execu...

CVE-2024-46213HIGH7.2ten sam produkt

REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.

CVE-2025-64050 — HIGH 7.2 | CVEbaza.pl