{"action":"Upgrade redaxo/source to 5.21.2 or later.","affected":[{"fixed":"5.21.2","introduced":"0"}],"component":"redaxo/source","cve_ids":["CVE-2026-62998"],"ecosystem":"Packagist","epss":0.00388,"exploited":false,"fixed_versions":["5.21.2"],"ghsa_id":"GHSA-4f5f-j737-pm58","id":"tcs_01M5KETXK1NP8FDX4TZJENZ8FD","modified_at":"2026-09-24T15:00:04.704179552Z","published_at":"2026-09-24T14:57:07Z","references":["https://osv.dev/vulnerability/GHSA-4f5f-j737-pm58","https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58","https://nvd.nist.gov/vuln/detail/CVE-2026-62998","https://github.com/redaxo/core/pull/6580","https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd","https://github.com/redaxo/core","https://github.com/redaxo/core/releases/tag/5.21.2"],"severity":{"label":"medium","score":4.3},"sources":[{"source":"osv","source_id":"GHSA-4f5f-j737-pm58","url":"https://osv.dev/vulnerability/GHSA-4f5f-j737-pm58"}],"summary":"REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration"}