https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-63002.htmlhttps://patchthecve.com/cve/CVE-2026-63002.htmlMon, 19 Oct 2026 20:36:13 +0000MEDIUM 4.8: REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in thhttps://patchthecve.com/cve/CVE-2026-63001.htmlhttps://patchthecve.com/cve/CVE-2026-63001.htmlMon, 19 Oct 2026 20:35:19 +0000MEDIUM 4.8: REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media https://patchthecve.com/cve/CVE-2026-63000.htmlhttps://patchthecve.com/cve/CVE-2026-63000.htmlMon, 19 Oct 2026 20:35:09 +0000MEDIUM 6.4: REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can chttps://patchthecve.com/cve/CVE-2026-62998.htmlhttps://patchthecve.com/cve/CVE-2026-62998.htmlMon, 19 Oct 2026 19:37:26 +0000MEDIUM 4.3: REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an es