CVE-2026-62998

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.

• CWE-20
• CWE-200

• https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efdPatch
• https://github.com/redaxo/core/pull/6580Issue Tracking, Patch
• https://github.com/redaxo/core/releases/tag/5.21.2Release Notes
• https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58Exploit, Vendor Advisory
• https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58Exploit, Vendor Advisory

Published

Sep 23, 2026

Last Modified

Oct 19, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62992Smarty is a template engine for PHP, facilitating the separa…6.9
• CVE-2026-62993Smarty is a template engine for PHP, facilitating the separa…6.9
• CVE-2026-62994CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14…3.7
• CVE-2026-62995joserfc is a Python library that provides an implementation …2.3
• CVE-2026-62996Smarty is a template engine for PHP, facilitating the separa…6.9
• CVE-2026-62997Kedro-Datasets provides data connectors for Kedro. From vers…7.7
• CVE-2026-62999Copier is a library and CLI app for rendering project templa…7.5
• CVE-2026-6300Use after free in CSS in Google Chrome prior to 147.0.7727.1…8.8
• CVE-2026-63000REDAXO is a PHP-based content management system. Prior to 5.…6.4
• CVE-2026-63001REDAXO is a PHP-based content management system. Prior to 5.…4.8
• CVE-2026-63002REDAXO is a PHP-based content management system. Prior to 5.…4.8
• CVE-2026-63003django CMS is an easy-to-use and developer-friendly enterpri…6.5