contao/core-bundle vulnerabilities (Packagist)
40 vulnerabilities.
-
contao/core-bundlePackagist Contao: Improper access control in the table access voter 4.3 Medium -
contao/core-bundlePackagist Contao: Improper access control in the preview links module 4.3 Medium -
contao/core-bundlePackagist Contao: Cross-site request forgery in custom backend actions 3.5 Low -
contao/core-bundlePackagist Contao: Path traversal in the images controller 5.3 Medium -
contao/core-bundlePackagist Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check 5.3 Medium -
contao/core-bundlePackagist Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled 5.3 Medium -
contao/core-bundlePackagist Contao: Possible path traversal in job download URIs 3.1 Low -
contao/core-bundlePackagist Contao crawler leaks auth credentials to external hosts 2.6 Low -
contao/core-bundlePackagist Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module 3.1 Low -
contao/core-bundlePackagist Contao is vulnerable to cross-site scripting in templates 3.3 Low -
contao/core-bundlePackagist Contao is vulnerable to remote code execution in template closures 6.6 Medium -
contao/core-bundlePackagist Contao has improper privilege management for page and article fields 4.3 Medium -
contao/core-bundlePackagist Contao discloses information in the news module 5.3 Medium -
contao/core-bundlePackagist Contao discloses sensitive information in the front end search index 5.3 Medium -
contao/core-bundlePackagist Contao has improper access control in the back end voters 4.3 Medium -
contao/core-bundlePackagist Contao allows cross-site scripting through SVG uploads 4.8 Medium -
contao/core-bundlePackagist Insert tag injection via canonical URL in Contao 5.3 Medium -
contao/core-bundlePackagist Directory traversal in the file selector widget in contao/core-bundle 4.3 Medium -
contao/core-bundlePackagist Remote command execution through file upload in contao/core-bundle 8.3 High -
contao/core-bundlePackagist Contao's remember-me tokens will not be cleared after a password change 5.9 Medium -
contao/core-bundlePackagist Contao possible cookie sharing with external domains while checking protected pages for broken links 8.4 High -
contao/core-bundlePackagist Contao may have unencoded insert tags in the frontend 3.1 Low -
contao/core-bundlePackagist Contao core bundle vulnerable to cross site scripting in the file manager 5.4 Medium -
contao/core-bundlePackagist Contao cross site scripting vulnerability via input unit widget 6.5 Medium -
contao/core-bundlePackagist Cross site scripting via canonical tag 7.2 High -
contao/core-bundlePackagist Cross site scripting via HTML attributes in the back end 4.8 Medium -
contao/core-bundlePackagist Privilege escalation via form generator 8.0 High -
contao/core-bundlePackagist PHP file inclusion via insert tags 7.2 High -
contao/core-bundlePackagist Cross site scripting in the system log 6.1 Medium -
contao/core-bundlePackagist Contao Insert tag injection in forms 5.3 Medium -
contao/core-bundlePackagist Cross-site Scripting in Contao 6.1 Medium -
contao/core-bundlePackagist Unrestricted file uploads in Contao 8.8 High -
contao/core-bundlePackagist Insert tag injection in the Contao login module 5.3 Medium -
contao/core-bundlePackagist Information disclosure in the Contao backend 5.3 Medium -
contao/core-bundlePackagist Contao SQL injection in the file manager 9.8 Critical -
contao/core-bundlePackagist Contao SQL injection in the backend and listing module 9.8 Critical -
contao/core-bundlePackagist Contao CSRF Token Bypass 8.8 High -
contao/core-bundlePackagist Contao Does Not Expire Tokens Correctly 9.8 Critical -
contao/core-bundlePackagist Contao Does Not Invalidate Existing Sessions When Password Changes 9.8 Critical -
contao/core-bundlePackagist Contao Core directory traversal vulnerability 8.8 High