CVE-2025-64050
HighCVSS 7.2Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload executes when visitors access frontend pages using the compromised template.
Risk Assessment
Compromise of a CMS administrator account leads to arbitrary command execution on the server, potentially resulting in full hosting compromise and data leakage.
Recommendation
Update REDAXO CMS to a patched version, restrict administrative privileges, and verify template integrity.
Other vulnerabilities in REDAXO CMS
See all- CVE-2016-20053Medium
Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.
- CVE-2025-64049Medium
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding a slice that uses the compromised module.
Original NVD description (English source)
A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS