CVE-2025-27412: Redaxo

Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days.

REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting (XSS) on the page of AddOns. This vulnerability is fixed in 5.18.3.

Affected products

• Redaxo Redaxo: from 5.0, before 5.18.3 (fixed in 5.18.3)

Published 2025-03-05. Last modified 2026-06-17.