CVE-2025-64049

4.8 mediumEPSS 0.3%

Medium (4.8) in redaxo redaxo. EPSS 0.3% chance of exploitation in the next 30 days.

A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-11-25
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

redaxo:redaxo

References

https://drive.google.com/drive/folders/1SpwL548ZBRYU_uL8W7Riv7VHshr2UN0R?usp=sharing
https://github.com/redaxo/redaxo
https://github.com/vettrivel007/CVE-Disclosures/blob/main/CVE-2025-64049.md

Check your stack JSON