{"action":"Upgrade redaxo/source to 5.18.3 or later.","affected":[{"fixed":"5.18.3","introduced":"5.0.0"}],"component":"redaxo/source","cve_ids":["CVE-2025-27412"],"ecosystem":"Packagist","epss":0.00287,"exploited":false,"fixed_versions":["5.18.3"],"ghsa_id":"GHSA-8366-xmgf-334f","id":"tcs_01M5KEYK2ZVW317P5X5F9V3AZD","modified_at":"2025-03-05T19:27:11.520944Z","published_at":"2025-03-05T19:03:08Z","references":["https://osv.dev/vulnerability/GHSA-8366-xmgf-334f","https://github.com/redaxo/redaxo/security/advisories/GHSA-8366-xmgf-334f","https://nvd.nist.gov/vuln/detail/CVE-2025-27412","https://github.com/redaxo/redaxo"],"severity":{"label":"medium","score":6.1},"sources":[{"source":"osv","source_id":"GHSA-8366-xmgf-334f","url":"https://osv.dev/vulnerability/GHSA-8366-xmgf-334f"}],"summary":"REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation"}