CVE-2026-62998
mediumREDAXO is a PHP-based content management system.
Vendor / product: Redaxo — redaxo
REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.
CVSS
4.3
4.3 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Severity source: NVD CVSS v3.1 (security-advisories@github.com)
Timeline (UTC)
Published: 2026-09-23 15:17
Modified: 2026-10-19 19:37
NVD status: Analyzed
Last synced 3 days ago
Verified against the source API 2026-10-27 06:55 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).
Affected products
redaxo / redaxo <5.21.2
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
Patch / mitigation: https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd
Patch / mitigation: https://github.com/redaxo/core/pull/6580
References
- https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd security-advisories@github.com
- https://github.com/redaxo/core/pull/6580 security-advisories@github.com
- https://github.com/redaxo/core/releases/tag/5.21.2 security-advisories@github.com
- https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58 security-advisories@github.com
- https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58 134c704f-9b21-4f2e-91b3-4a467353bcc0
Data sources
NVD CVE API 2.0 — fetched 2026-10-27 06:55 UTC · record ↗