[MEDIUM] REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

PKSA-61tb-yjv2-q4wp CVE-2026-62998 GHSA-4f5f-j737-pm58

Affected version: <=5.21.1

Reported by:
GitHub

[MEDIUM] REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

PKSA-759m-q6p6-jn53 CVE-2026-63000 GHSA-m8r3-22v6-g877

Affected version: <=5.21.1

Reported by:
GitHub

[MEDIUM] REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

PKSA-hw96-c37g-vqkw CVE-2026-63002 GHSA-w998-qmw9-mf4m

Affected version: <=5.21.1

Reported by:
GitHub

[MEDIUM] REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

PKSA-hspm-hyxh-6wd5 CVE-2026-63001 GHSA-mf2p-wjp4-99pq

Affected version: <=5.21.1

Reported by:
GitHub