How severe is CVE-2016-20053?

CVE-2016-20053 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.

Is CVE-2016-20053 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2016-20053?

CVE-2016-20053 affects Redaxo. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2016-20053?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2016-20053 have an EU (EUVD) identifier?

Yes. CVE-2016-20053 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2016-10861.

When was CVE-2016-20053 published?

CVE-2016-20053 was published on 2026-04-04 and last updated on 2026-06-17.

CVE-2016-20053

CVE-2016-20053 is a medium-severity vulnerability in Redaxo with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-352.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 6.9
EPSS exploit prediction: 0% (4th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2016-10861
Weakness: CWE-352
Affected product: Redaxo
Published: 2026-04-04
Last modified: 2026-06-17

Description

Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.

Frequently asked questions

What is CVE-2016-20053?: Redaxo CMS 5.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by tricking authenticated administrators into visiting malicious pages. Attackers can craft HTML forms targeting the users endpoint with hidden fields containing admin credentials and account parameters to add new administrator accounts without user consent.
How severe is CVE-2016-20053?: CVE-2016-20053 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2016-20053 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2016-20053?: CVE-2016-20053 affects Redaxo. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2016-20053?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2016-20053 have an EU (EUVD) identifier?: Yes. CVE-2016-20053 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2016-10861.
When was CVE-2016-20053 published?: CVE-2016-20053 was published on 2026-04-04 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:redaxo:redaxo:5.2:*:*:*:*:*:*:*

More vulnerabilities in Redaxo

CVE-2018-18200 — Critical (CVSS 9.8): There is a SQL injection in Benutzerverwaltung in REDAXO before 5.6.4.
CVE-2018-17831 — Critical (CVSS 9.8): In REDAXO before 5.6.3, a critical SQL injection vulnerability has been discovered in the rex_list class because of the…
CVE-2006-2845 — High (CVSS 7.5): PHP remote file inclusion vulnerability in Redaxo 3.0 up to 3.2 allows remote attackers to execute arbitrary PHP code…
CVE-2006-2844 — High (CVSS 7.5): Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code…
CVE-2006-2843 — High (CVSS 7.5): PHP remote file inclusion vulnerability in Redaxo 2.7.4 allows remote attackers to execute arbitrary PHP code via a URL…
CVE-2025-64050 — High (CVSS 7.2): A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote…

All CVEs affecting Redaxo →

Other CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities

CVE-2025-32642 — Critical (CVSS 10.0): Cross-Site Request Forgery (CSRF) vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This…
CVE-2025-23922 — Critical (CVSS 10.0): Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a…
CVE-2017-5145 — Critical (CVSS 10.0): An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware…
CVE-2019-25729 — Critical (CVSS 9.8): PDF Signer 3.0 contains a server-side template injection vulnerability that allows unauthenticated attackers to execute…
CVE-2025-48340 — Critical (CVSS 9.8): Cross-Site Request Forgery (CSRF) vulnerability in Danny Vink User Profile Meta Manager user-profile-meta allows…
CVE-2025-2907 — Critical (CVSS 9.8): The Order Delivery Date WordPress plugin before 12.3.1 does not have authorization and CSRF checks when importing…

Browse all CWE-352 (Cross-Site Request Forgery (CSRF)) vulnerabilities →