PHP-based Content Management System Vulnerability in REDAXO

CVE-2026-62998

What is CVE-2026-62998?

In versions of REDAXO CMS prior to 5.21.2, the method rex_list::getSortColumn() did not properly validate the sort request parameter. An authenticated backend user could exploit this oversight to manipulate queries using unregistered columns, potentially gaining access to unauthorized data. This could result in the exposure of sensitive information from the database, such as user passwords, through error-based enumeration techniques. The vulnerability has been addressed in the 5.21.2 update, which enhances input validation and security measures.

References