CVE-2026-62998Medium· 4.3▾ TwilightPoC availableREDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Exploit / PoC code exists
0.3%
0.3% → 0.4%
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
redaxo/source <= 5.21.1Patched in:
redaxo/source 5.21.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63000Medium· 6.4REDAXO is a PHP-based content management system
CVE-2026-63002Medium· 4.8REDAXO is a PHP-based content management system
CVE-2026-63001Medium· 4.8REDAXO is a PHP-based content management system
CVE-2026-116186Low· 2.3OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId
CVE-2026-53582High· 7.1OPNsense is a FreeBSD based firewall and routing platform
CVE-2026-58391Medium· 5.4OPNsense is a FreeBSD based firewall and routing platform