{"kind": "product", "path": "vulns/packagist/redaxo%2Fsource", "name": "redaxo/source", "product": "redaxo/source", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-63000", "noindex": false, "published": "2026-09-23T14:08:42.402Z", "modified": "2026-09-29T01:56:35.810Z", "cvss": 6.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L", "severity": "medium", "epss": 0.00149, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-63000", "title": "REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates", "description": "REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.", "references": ["https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877", "https://github.com/redaxo/core/pull/6579", "https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3"], "fixes": ["5.21.2"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-62998", "noindex": false, "published": "2026-09-23T14:07:04.529Z", "modified": "2026-09-23T15:22:46.380Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00388, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-62998", "title": "REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration", "description": "REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.", "references": ["https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58", "https://github.com/redaxo/core/pull/6580", "https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd"], "fixes": ["5.21.2"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-63002", "noindex": false, "published": "2026-09-23T14:05:39.056Z", "modified": "2026-09-24T14:26:12.432Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00197, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-63002", "title": "REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames", "description": "REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.", "references": ["https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m", "https://github.com/redaxo/core/pull/6581", "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"], "fixes": ["5.21.2"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-63001", "noindex": false, "published": "2026-09-23T14:03:12.137Z", "modified": "2026-09-23T19:45:21.599Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00197, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-63001", "title": "REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`", "description": "REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.", "references": ["https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq", "https://github.com/redaxo/core/pull/6581", "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"], "fixes": ["5.21.2"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-53599", "noindex": false, "published": "2026-07-31T19:43:15.663Z", "modified": "2026-07-31T21:39:28.144Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00508, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-53599", "title": "Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers", "description": "REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.", "references": ["https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25", "https://github.com/redaxo/core/pull/6538", "https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340"], "fixes": ["5.21.1"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "GHSA-xq4j-g85q-wf97", "noindex": false, "published": "2026-04-10T19:40:42Z", "modified": "2026-04-10T19:49:39.034910Z", "cvss": null, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-xq4j-g85q-wf97", "title": "REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)", "description": "### Summary\n\nA **reflected XSS** vulnerability has been identified in the REDAXO backend. The `function` parameter is concatenated into an API error message and rendered without HTML escaping.\n\n---\n\n### Details\n\n**Root cause**\nUser input `function` is injected into an exception message, then rendered by `rex_view::error()` which delegates to `rex_view::message()` without HTML escaping.\n\n**Vulnerable code (`redaxo/src/core/lib/packages/api_package.php`) :**\n\n```php\n$function = rex_request('function', 'string');\nthrow new rex_api_exception('Unknown package function \"' . $function . '\"!');\n```\n\n**Sink (`redaxo/src/core/lib/view.php`) :**\n\n```php", "references": ["https://github.com/redaxo/core/security/advisories/GHSA-xq4j-g85q-wf97", "https://github.com/redaxo/core", "https://github.com/redaxo/core/releases/tag/5.21.0"], "fixes": ["5.21.0"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "GHSA-m662-8jrj-cw6v", "noindex": false, "published": "2026-04-10T19:40:23Z", "modified": "2026-04-10T19:49:11.559366Z", "cvss": null, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/ghsa-m662-8jrj-cw6v", "title": "REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)", "description": "### Summary\n\nA **reflected XSS** vulnerability has been identified in the REDAXO backend. The `type` parameter is concatenated into an API error message and rendered without HTML escaping.\n\n---\n\n### Details\n\n**Root cause**  \nUser input `type` is injected into an exception message, then rendered by `rex_view::error()` which delegates to `rex_view::message()` without HTML escaping.\n\n**Vulnerable code (`redaxo/src/addons/metainfo/lib/handler/api_default_fields.php`) :**\n```php\n$type = rex_get('type', 'string');\nthrow new rex_api_exception(sprintf('metainfo type \"%s\" does not have default field.', $type));\n```\n\n**Sink (`redaxo/src/core/lib/view.p", "references": ["https://github.com/redaxo/core/security/advisories/GHSA-m662-8jrj-cw6v", "https://github.com/redaxo/core", "https://github.com/redaxo/core/releases/tag/5.21.0"], "fixes": ["5.21.0"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-21857", "noindex": false, "published": "2026-01-07T22:32:15.859Z", "modified": "2026-01-08T18:17:35.890Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N", "severity": "high", "epss": 0.00535, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-21857", "title": "Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read", "description": "REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue.", "references": ["https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv", "https://github.com/redaxo/redaxo/releases/tag/5.20.2", "https://nvd.nist.gov/vuln/detail/CVE-2026-21857"], "fixes": ["5.20.2"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-66026", "noindex": false, "published": "2025-11-26T02:01:44.814Z", "modified": "2025-11-26T15:14:37.329Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00268, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-66026", "title": "REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]", "description": "REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context when an authenticated user visits a crafted link while logged in. This issue has been patched in version 5.20.1.", "references": ["https://github.com/redaxo/redaxo/security/advisories/GHSA-x6vr-q3vf-vqgq", "https://github.com/redaxo/redaxo/commit/58929062312cf03e344ab04067a365e6b6ee66aa", "https://nvd.nist.gov/vuln/detail/CVE-2025-66026"], "fixes": ["5.20.1"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-64050", "noindex": false, "published": "2025-11-25T00:00:00.000Z", "modified": "2025-11-25T15:51:09.606Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00908, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-64050", "title": "CVE-2025-64050", "description": "A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.", "references": ["https://github.com/redaxo/redaxo", "https://drive.google.com/drive/folders/1Via4r4wn5zCcBllWmHpxYweCPgcbN0bz?usp=sharing", "https://github.com/vettrivel007/CVE-Disclosures/blob/main/CVE-2025-64050.md"], "fixes": ["5.20.1"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-64049", "noindex": false, "published": "2025-11-25T00:00:00.000Z", "modified": "2025-11-25T15:57:41.553Z", "cvss": 4.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00309, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-64049", "title": "CVE-2025-64049", "description": "A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.", "references": ["https://github.com/redaxo/redaxo", "https://drive.google.com/drive/folders/1SpwL548ZBRYU_uL8W7Riv7VHshr2UN0R?usp=sharing", "https://github.com/vettrivel007/CVE-Disclosures/blob/main/CVE-2025-64049.md"], "fixes": ["5.20.1"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-27412", "noindex": false, "published": "2025-03-05T15:53:08.813Z", "modified": "2025-03-05T16:18:31.199Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00287, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-27412", "title": "REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation", "description": "REDAXO is a PHP-based CMS. In Redaxo from 5.0.0 through 5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting (XSS) on the page of AddOns. This vulnerability is fixed in 5.18.3.", "references": ["https://github.com/redaxo/redaxo/security/advisories/GHSA-8366-xmgf-334f", "https://nvd.nist.gov/vuln/detail/CVE-2025-27412"], "fixes": ["5.18.3"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2025-27411", "noindex": false, "published": "2025-03-05T15:42:29.888Z", "modified": "2025-03-06T22:00:09.152Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00281, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2025-27411", "title": "REDAXO allows Arbitrary File Upload in the mediapool page", "description": "REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.", "references": ["https://github.com/redaxo/redaxo/security/advisories/GHSA-wppf-gqj5-fc4f", "https://github.com/redaxo/redaxo/commit/3b2159bb45da0ab6cfaef5c8cf8b602ee5e2fb37", "https://nvd.nist.gov/vuln/detail/CVE-2025-27411"], "fixes": ["5.18.3"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-13209", "noindex": false, "published": "2025-01-09T03:00:15.362Z", "modified": "2025-01-09T15:50:00.953Z", "cvss": 5.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.004, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-13209", "title": "Redaxo CMS Structure Management Page index.php cross site scripting", "description": "A vulnerability was found in Redaxo CMS 5.18.1. It has been classified as problematic. Affected is an unknown function of the file /index.php?page=structure&category_id=1&article_id=1&clang=1&function=edit_art&artstart=0 of the component Structure Management Page. The manipulation of the argument Article Name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "references": ["https://vuldb.com/?id.290814", "https://vuldb.com/?ctiid.290814", "https://vuldb.com/?submit.466396"], "fixes": ["5.18.2"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-46209", "noindex": false, "published": "2025-01-06T00:00:00.000Z", "modified": "2025-01-07T15:44:03.591Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00422, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-46209", "title": "CVE-2024-46209", "description": "A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the password parameter.", "references": ["https://github.com/h4ckr4v3n/research_redaxo_5_17_1.git", "https://github.com/h4ckr4v3n/CVE-2024-46209/blob/main/REDAXO%20Stored%20XSS%20%2B%20RCE.pdf", "https://nvd.nist.gov/vuln/detail/CVE-2024-46209"], "fixes": [], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-50803", "noindex": false, "published": "2024-11-19T00:00:00.000Z", "modified": "2026-07-05T16:04:58.664Z", "cvss": 6.1, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "severity": "medium", "epss": 0.00536, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-50803", "title": "CVE-2024-50803", "description": "The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges", "references": ["https://github.com/Praison001/CVE-2024-50803-Redaxo", "https://nvd.nist.gov/vuln/detail/CVE-2024-50803"], "fixes": ["5.18.0"], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-46212", "noindex": false, "published": "2024-10-16T00:00:00.000Z", "modified": "2024-10-17T17:02:19.131Z", "cvss": 4.9, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "severity": "medium", "epss": 0.00866, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-46212", "title": "CVE-2024-46212", "description": "An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.", "references": ["https://github.com/Purposex7/Vulns4Study/blob/main/REDAXO%20File%20Download%20Exploit.md", "https://nvd.nist.gov/vuln/detail/CVE-2024-46212"], "fixes": [], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}, {"id": "CVE-2024-25298", "noindex": false, "published": "2024-02-17T00:00:00.000Z", "modified": "2024-08-29T18:04:00.756Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01108, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2024-25298", "title": "CVE-2024-25298", "description": "An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.", "references": ["https://github.com/CpyRe/I-Find-CVE-2024/blob/main/REDAXO%20RCE.md", "https://nvd.nist.gov/vuln/detail/CVE-2024-25298"], "fixes": [], "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}]}], "total": 18, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "redaxo/source", "path": "vulns/packagist/redaxo%2Fsource", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-29T01:56:35.810Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}