Contao
Monthly
Stored cross-site scripting in the Contao CMS comments bundle lets an unauthenticated visitor submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php, so attacker-controlled script executes in the Contao backend origin when a backend user opens the Comments module. All Contao releases from 4.0.0 up to (but not including) 5.3.50 and 5.7.12 are affected, and successful exploitation requires a privileged backend user to view the Comments module (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C); no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Critically, moderation is not a mitigating control because unpublished/pending comments remain visible to moderators, so an unapproved malicious comment still triggers in that user's session.
Blind SQL injection in Isotope eCommerce through 2.9.10 allows authenticated Contao backend users with Isotope module permissions to manipulate backend SQL queries and extract arbitrary database contents, including password hashes from the tl_user table. Exploitation requires a legitimate backend session with Isotope permissions and is limited to blind conditional or time-based techniques; no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data. The independent assessment rates confidentiality impact as high, integrity impact as low, and availability impact as none, emphasizing that this is a genuine but access-gated vulnerability and not a mass-exploitation threat.
Improper access control in Contao CMS 5.7.0 through 5.7.11 lets an authenticated, low-privileged backend user read, create, update, or delete records in Data Container tables that fall outside their assigned module permissions - including tables holding member records and newsletter-subscriber e-mail addresses. The root cause is a caching defect in TableAccessVoter, which stores authorization decisions under a key built only from the user's security token and omits the table name returned by getDataSource(), so a decision made for a permitted table can be silently reused for a different, forbidden table within the same request, with DefaultDataContainerVoter able to turn the resulting abstention into a grant. Exploitation requires valid backend credentials and the specific request ordering of an allowed-table check preceding a denied-table check, and no public exploit code has been identified at time of analysis; the issue is rated moderate severity (vendor CVSS 4.3, assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
Improper access control in Contao CMS 5.7.1 through 5.7.11 lets an authenticated non-administrator backend user whose group holds the preview_link module list every tl_preview_link record and lift other users' already-signed share URLs, then follow them to view unpublished or embargoed pages without holding page permission. The failure is deterministic in default configurations because a service-registration typo silently drops the ownership voter at container compile time and no createdBy SQL filter compensates, so no special setting has to be toggled on; exposure depends on having a non-admin backend account with the preview_link module granted. No public exploit code has been identified at time of analysis, the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3) rates it low-to-medium, and the issue is fixed in 5.7.12.
Cross-site request forgery in Contao CMS's backend action dispatch allows an attacker to make an authenticated backend user silently execute destructive or state-changing backend operations by simply loading an attacker-controlled URL. The flaw exists because RequestTokenListener - the only generic REQUEST_TOKEN validator in Contao - runs on POST requests only, while the GET-side guard is local and declarative and fires solely when an 'act' parameter is present, leaving every backend action dispatched through a different parameter (notably 'key=') with no CSRF protection at all; the CSRF validation added in the fix reads the token from the 'rt' query parameter. The assessed CVSS v3.1 score is only 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) because exploitation requires a valid backend session AND user interaction (the victim must be socially engineered into loading the crafted link), and the reachable actions are limited to modules that victim user can already access - the advisory verified only destructive/state-changing actions, not privilege escalation. Vendor-released patch: 5.3.50 and 5.7.12; no public exploit identified at time of analysis.
Unauthenticated path traversal in the Contao CMS ImagesController lets remote attackers read files from the project directory by supplying encoded parent-directory segments in the image route's {path} parameter. Affected versions are Contao 5.0.0 through 5.3.49 and 5.7.11 (fixed in 5.3.50 and 5.7.12), with impact constrained by the fact that a returned file must carry an extension listed in contao.image.valid_extensions and files below the upload directory were not demonstrated to be readable, making this extension-restricted disclosure plus path-existence probing rather than arbitrary file read. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), no public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates the issue as moderate rather than critical.
Unauthenticated email-flooding and user-enumeration in Contao CMS: a POST to any page containing the registration module reaches ModuleRegistration::compile()'s follow-up registration branch without validating FORM_SUBMIT or the preceding captcha, so resendActivationMail() invokes OptInToken::send() with no rate limit. An attacker can therefore repeatedly trigger activation emails to an address that has a pending registration and, via the observable difference in response, determine whether that pending registration exists. Affected versions run from 4.1.0 up to (but not including) 5.3.50 and 5.7.12, and exploitation requires reg_activate to be enabled plus target-side pending-registration state, which keeps this at a modest severity (CVSS 5.3, PR:N/UI:N, confidentiality-only impact); no public exploit identified at time of analysis.
Information disclosure in Contao CMS allows unauthenticated front-end visitors to read the titles, URLs, and indexed text snippets of protected pages through the ModuleSearch search module. The exposure only occurs on sites that previously enabled contao.search.index_protected (so protected pages were written into the tl_search index with per-row authorization metadata) and then disabled that setting without purging the stale index rows; the affected versions are 4.0.0 through the 5.3.x branch before 5.3.50 and 5.7.x before 5.7.12, with fixes released in 5.3.50 and 5.7.12. Exploitation is unauthenticated and requires no user interaction, but there is no public exploit identified at time of analysis, the underlying protected pages still enforce their own authorization checks, and the real-world risk is genuinely low because it depends on that specific configuration transition.
Cross-job file read in Contao CMS 5.7.0-5.7.6 allows authenticated backend users to exfiltrate job attachments belonging to other jobs by injecting path traversal sequences into the attachment identifier parameter. The job attachment download controller authorizes only the jobUuid route parameter, then constructs the actual file path by joining that authorized UUID with the attacker-supplied identifier; Contao's VirtualFilesystem::resolve() canonicalizes the combined path but rejects only escapes from the filesystem mount, not cross-job traversals within the mount. No public exploit has been identified at time of analysis, and the CVSS 3.1 Low score of 3.1 reflects meaningful exploitation barriers: backend authentication and prior knowledge of a victim job UUID are both required.
Server-Side Request Forgery in Contao CMS's Feed Reader front-end module enables authenticated backend users to pivot the web server against internal network resources, cloud metadata endpoints, or loopback services. Affected are Contao 5.3.35-5.3.47 and 5.7.0-RC1-5.7.8; exploitation requires a backend account with module-edit permissions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; risk is primarily relevant to multi-tenant or SaaS Contao deployments where untrusted backend users exist.
Contao is an Open Source CMS. Rated low severity (CVSS 3.3), this vulnerability is remotely exploitable. No vendor patch available.
Contao is an Open Source CMS. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
Contao is an Open Source CMS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Contao is an Open Source CMS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Contao is an Open Source CMS. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Contao is an Open Source CMS. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Contao is an Open Source CMS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Contao before 5.5.6 allows XSS via an SVG document. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Contao is an Open Source CMS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao is an Open Source CMS. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao is an Open Source CMS. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao is an open source content management system. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.
Contao is an open source content management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Contao is an open source content management system. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Contao is an open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Contao is an open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Contao is an open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Contao is an open source content management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao is an open source CMS that allows creation of websites and scalable web applications. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao is an open source CMS that allows you to create websites and scalable web applications. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao 4.0 through 4.8.5 allows PHP local file inclusion. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao 4.0 through 4.8.5 has Insecure Permissions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao 4.x allows SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao 4.7 allows Use of a Key Past its Expiration Date. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao 4.7 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the Contao CMS comments bundle lets an unauthenticated visitor submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php, so attacker-controlled script executes in the Contao backend origin when a backend user opens the Comments module. All Contao releases from 4.0.0 up to (but not including) 5.3.50 and 5.7.12 are affected, and successful exploitation requires a privileged backend user to view the Comments module (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C); no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Critically, moderation is not a mitigating control because unpublished/pending comments remain visible to moderators, so an unapproved malicious comment still triggers in that user's session.
Blind SQL injection in Isotope eCommerce through 2.9.10 allows authenticated Contao backend users with Isotope module permissions to manipulate backend SQL queries and extract arbitrary database contents, including password hashes from the tl_user table. Exploitation requires a legitimate backend session with Isotope permissions and is limited to blind conditional or time-based techniques; no public exploit identified at time of analysis, and no CISA KEV entry is present in the provided data. The independent assessment rates confidentiality impact as high, integrity impact as low, and availability impact as none, emphasizing that this is a genuine but access-gated vulnerability and not a mass-exploitation threat.
Improper access control in Contao CMS 5.7.0 through 5.7.11 lets an authenticated, low-privileged backend user read, create, update, or delete records in Data Container tables that fall outside their assigned module permissions - including tables holding member records and newsletter-subscriber e-mail addresses. The root cause is a caching defect in TableAccessVoter, which stores authorization decisions under a key built only from the user's security token and omits the table name returned by getDataSource(), so a decision made for a permitted table can be silently reused for a different, forbidden table within the same request, with DefaultDataContainerVoter able to turn the resulting abstention into a grant. Exploitation requires valid backend credentials and the specific request ordering of an allowed-table check preceding a denied-table check, and no public exploit code has been identified at time of analysis; the issue is rated moderate severity (vendor CVSS 4.3, assessed CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N).
Improper access control in Contao CMS 5.7.1 through 5.7.11 lets an authenticated non-administrator backend user whose group holds the preview_link module list every tl_preview_link record and lift other users' already-signed share URLs, then follow them to view unpublished or embargoed pages without holding page permission. The failure is deterministic in default configurations because a service-registration typo silently drops the ownership voter at container compile time and no createdBy SQL filter compensates, so no special setting has to be toggled on; exposure depends on having a non-admin backend account with the preview_link module granted. No public exploit code has been identified at time of analysis, the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3) rates it low-to-medium, and the issue is fixed in 5.7.12.
Cross-site request forgery in Contao CMS's backend action dispatch allows an attacker to make an authenticated backend user silently execute destructive or state-changing backend operations by simply loading an attacker-controlled URL. The flaw exists because RequestTokenListener - the only generic REQUEST_TOKEN validator in Contao - runs on POST requests only, while the GET-side guard is local and declarative and fires solely when an 'act' parameter is present, leaving every backend action dispatched through a different parameter (notably 'key=') with no CSRF protection at all; the CSRF validation added in the fix reads the token from the 'rt' query parameter. The assessed CVSS v3.1 score is only 3.5 (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) because exploitation requires a valid backend session AND user interaction (the victim must be socially engineered into loading the crafted link), and the reachable actions are limited to modules that victim user can already access - the advisory verified only destructive/state-changing actions, not privilege escalation. Vendor-released patch: 5.3.50 and 5.7.12; no public exploit identified at time of analysis.
Unauthenticated path traversal in the Contao CMS ImagesController lets remote attackers read files from the project directory by supplying encoded parent-directory segments in the image route's {path} parameter. Affected versions are Contao 5.0.0 through 5.3.49 and 5.7.11 (fixed in 5.3.50 and 5.7.12), with impact constrained by the fact that a returned file must carry an extension listed in contao.image.valid_extensions and files below the upload directory were not demonstrated to be readable, making this extension-restricted disclosure plus path-existence probing rather than arbitrary file read. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), no public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates the issue as moderate rather than critical.
Unauthenticated email-flooding and user-enumeration in Contao CMS: a POST to any page containing the registration module reaches ModuleRegistration::compile()'s follow-up registration branch without validating FORM_SUBMIT or the preceding captcha, so resendActivationMail() invokes OptInToken::send() with no rate limit. An attacker can therefore repeatedly trigger activation emails to an address that has a pending registration and, via the observable difference in response, determine whether that pending registration exists. Affected versions run from 4.1.0 up to (but not including) 5.3.50 and 5.7.12, and exploitation requires reg_activate to be enabled plus target-side pending-registration state, which keeps this at a modest severity (CVSS 5.3, PR:N/UI:N, confidentiality-only impact); no public exploit identified at time of analysis.
Information disclosure in Contao CMS allows unauthenticated front-end visitors to read the titles, URLs, and indexed text snippets of protected pages through the ModuleSearch search module. The exposure only occurs on sites that previously enabled contao.search.index_protected (so protected pages were written into the tl_search index with per-row authorization metadata) and then disabled that setting without purging the stale index rows; the affected versions are 4.0.0 through the 5.3.x branch before 5.3.50 and 5.7.x before 5.7.12, with fixes released in 5.3.50 and 5.7.12. Exploitation is unauthenticated and requires no user interaction, but there is no public exploit identified at time of analysis, the underlying protected pages still enforce their own authorization checks, and the real-world risk is genuinely low because it depends on that specific configuration transition.
Cross-job file read in Contao CMS 5.7.0-5.7.6 allows authenticated backend users to exfiltrate job attachments belonging to other jobs by injecting path traversal sequences into the attachment identifier parameter. The job attachment download controller authorizes only the jobUuid route parameter, then constructs the actual file path by joining that authorized UUID with the attacker-supplied identifier; Contao's VirtualFilesystem::resolve() canonicalizes the combined path but rejects only escapes from the filesystem mount, not cross-job traversals within the mount. No public exploit has been identified at time of analysis, and the CVSS 3.1 Low score of 3.1 reflects meaningful exploitation barriers: backend authentication and prior knowledge of a victim job UUID are both required.
Server-Side Request Forgery in Contao CMS's Feed Reader front-end module enables authenticated backend users to pivot the web server against internal network resources, cloud metadata endpoints, or loopback services. Affected are Contao 5.3.35-5.3.47 and 5.7.0-RC1-5.7.8; exploitation requires a backend account with module-edit permissions. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; risk is primarily relevant to multi-tenant or SaaS Contao deployments where untrusted backend users exist.
Contao is an Open Source CMS. Rated low severity (CVSS 3.3), this vulnerability is remotely exploitable. No vendor patch available.
Contao is an Open Source CMS. Rated medium severity (CVSS 6.6), this vulnerability is remotely exploitable. No vendor patch available.
Contao is an Open Source CMS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
Contao is an Open Source CMS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.
Contao is an Open Source CMS. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Contao is an Open Source CMS. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Contao is an Open Source CMS. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Contao before 5.5.6 allows XSS via an SVG document. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Contao is an Open Source CMS. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao is an Open Source CMS. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao is an Open Source CMS. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao is an open source content management system. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity.
Contao is an open source content management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
Contao is an open source content management system. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Contao is an open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
Contao is an open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Contao is an open source content management system. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Contao is an open source content management system. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao is an open source CMS that allows creation of websites and scalable web applications. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao is an open source CMS that allows you to create websites and scalable web applications. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao 4.0 through 4.8.5 allows PHP local file inclusion. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao 4.0 through 4.8.5 has Insecure Permissions. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao 4.x allows SQL Injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao 4.7 allows Use of a Key Past its Expiration Date. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao 4.7 allows CSRF. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. This Path Traversal vulnerability could allow attackers to access files and directories outside the intended path.
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.