CVE-2016-20053

MEDIUM 5.3

Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

4th

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.

CWE	CWE-352
Vendor	redaxo
Product	redaxo cms
Published	Apr 4, 2026
Last Updated	Apr 6, 2026

Stay Ahead of the Next One

Get instant alerts for redaxo redaxo cms

Be the first to know when new medium vulnerabilities affecting redaxo redaxo cms are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

Redaxo / Redaxo CMS

5.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

exploit-db.com: https://www.exploit-db.com/exploits/40708 vulncheck.com: https://www.vulncheck.com/advisories/redaxo-cms-cross-site-request-forgery-via-users-endpoint

Credits

Ashiyane Digital Security Team