CVE-2026-63000
6.4 MEDIUMpublic exploit availablePublished 2026-09-23 · Updated 2026-09-29
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
Weaknesses
CWE-352
Public exploit & PoC references
- https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3
- https://github.com/redaxo/core/pull/6579
- https://github.com/redaxo/core/releases/tag/5.21.2
- https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877
- https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877
All references
- https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3
- https://github.com/redaxo/core/pull/6579
- https://github.com/redaxo/core/releases/tag/5.21.2
- https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877
- https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- CRITICALCVE-2025-15399
- MEDIUMCVE-2026-100524PoC
- MEDIUMCVE-2026-100712PoC
- UNSCOREDCVE-2026-100747
- UNSCOREDCVE-2026-100748
- UNSCOREDCVE-2026-100749
- MEDIUMCVE-2026-100873PoC
- MEDIUMCVE-2026-101093PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.