CVE-2019-19714

Insert tag injection in the Contao login module

5.3 MediumFix available

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.82%Up 0.2 points since Apr 14, 2021

What each source reports

NVD Score used 5.3

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

Record: CVE-2019-19714
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:N/I:P/A:N
Weakness: CWE-116
Updated: 2026-11-02

CVE List No score

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

Record: CVE-2019-19714
Updated: 2026-11-02

EUVDEUVD-2019-0796 No score

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

Record: EUVD-2019-0796
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jc43-qrrp-98f5 5.3

Insert tag injection in the Contao login module

Impact

It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

Patches

Update to Contao 4.8.6.

Workarounds

None.

References

https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

Record: GHSA-jc43-qrrp-98f5
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-116
Updated: 2026-11-02

OSV 5.3

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

Record: CVE-2019-19714
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

OSVGHSA-jc43-qrrp-98f5 5.3

Insert tag injection in the Contao login module

Impact

It is possible to inject insert tags into the login module which will be replaced when the page is rendered.

Patches

Update to Contao 4.8.6.

Workarounds

None.

References

https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module

For more information

If you have any questions or comments about this advisory, open an issue in contao/contao.

Record: GHSA-jc43-qrrp-98f5
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-116
Updated: 2026-11-02

Affected products

contao

Affected packages

Affected packages
Package	Affected	Fixed
`contao/core-bundle` Packagist	4.8.4 up to 4.8.6	4.8.6
`contao/contao` Packagist	4.8.4 up to 4.8.6	4.8.6
`contao/core-bundle` Packagist	4.8.4 up to 4.8.6, plus listed versions 4.8.5	4.8.6
`contao/contao` Packagist	4.8.4 up to 4.8.6, plus listed versions 4.8.5	4.8.6

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-19714 is a medium vulnerability (CVSS 5.3) in Contao, published December 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.82%, the 57th percentile. Fixed in contao/core-bundle 4.8.6.