CVE-2018-10125
Cross-site Scripting in Contao
Contao before 4.5.7 has XSS in the system log.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Contao before 4.5.7 has XSS in the system log.
- Record
CVE-2018-10125- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Contao before 4.5.7 has XSS in the system log.
- Record
CVE-2018-10125- Updated
- 2026-11-02
EUVDEUVD-2022-1129 No score
Contao before 4.5.7 has XSS in the system log.
- Record
EUVD-2022-1129- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pj4j-287j-f742
Cross-site Scripting in Contao
Contao before 4.5.7 has XSS in the system log.
- Record
GHSA-pj4j-287j-f742- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Contao before 4.5.7 has XSS in the system log.
- Record
CVE-2018-10125- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-pj4j-287j-f742
Cross-site Scripting in Contao
Contao before 4.5.7 has XSS in the system log.
- Record
GHSA-pj4j-287j-f742- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
contao/contaoPackagist |
4.0.0 up to 4.4.18 | 4.4.18 |
contao/contaoPackagist |
4.5.0 up to 4.5.8 | 4.5.8 |
contao/core-bundlePackagist |
4.0.0 up to 4.4.18 | 4.4.18 |
contao/core-bundlePackagist |
4.5.0 up to 4.5.8 | 4.5.8 |
contao/corePackagist |
3.0.0 up to 3.5.35 | 3.5.35 |
contao/core-bundlePackagist |
3.0.0 up to 3.5.35 | 3.5.35 |
contao/core-bundlePackagist |
4.0.0 up to 4.4.18, plus listed versions 4.0.14.0.24.0.34.0.44.1.0 Show 45 moreShow less4.1.0-RC14.1.0-beta14.1.14.1.24.1.34.2.04.2.0-RC14.2.0-beta14.2.14.2.24.2.34.2.44.2.54.3.04.3.0-RC14.3.14.3.104.3.114.3.24.3.34.3.44.3.54.3.64.3.74.3.84.3.94.4.04.4.0-RC14.4.0-RC24.4.0-beta14.4.14.4.104.4.114.4.124.4.134.4.144.4.154.4.164.4.174.4.24.4.34.4.44.4.54.4.64.4.7 |
4.4.18 |
contao/core-bundlePackagist |
4.5.0 up to 4.5.8, plus listed versions 4.5.14.5.24.5.34.5.44.5.54.5.64.5.7 |
4.5.8 |
contao/corePackagist |
3.0.0 up to 3.5.35, plus listed versions 3.0.13.0.23.0.33.0.43.0.5 Show 45 moreShow less3.0.63.1.03.1.13.1.23.1.33.1.43.1.53.1.RC13.1.beta13.2.03.2.13.2.103.2.113.2.123.2.133.2.143.2.153.2.163.2.173.2.183.2.193.2.23.2.203.2.213.2.33.2.43.2.53.2.63.2.73.2.83.2.93.2.RC13.2.beta13.2.beta23.3.03.3.0-RC13.3.0-RC23.3.0-beta13.3.13.3.23.3.33.3.43.3.53.3.63.3.7 |
3.5.35 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-10125 is a medium vulnerability (CVSS 6.1) in Contao, published March 16, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.84%, the 58th percentile. Fixed in contao/contao 4.4.18.
References
contao.org/en/security-advisories/cross-site-scripting-in-the-system-log.html
nvd.nist.gov/vuln/detail/CVE-2018-10125
github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2018-10125.yaml
Left out here: 47 versions. The JSON record has them.