Contao vulnerabilities

Products

• Contao 42
• Cms 11

Newest

• contao Contao: Improper access control in the table access voter CVE-2026-107851 Fix available 4.3 MediumOctober 9, 2026
• contao Contao: Improper access control in the preview links module CVE-2026-107850 Fix available 4.3 MediumOctober 9, 2026
• contao Contao: Cross-site request forgery in custom backend actions CVE-2026-107848 Fix available 3.5 LowOctober 9, 2026
• contao Contao: Cross-site scripting in the comments bundle CVE-2026-107845 Fix available 9.3 CriticalOctober 9, 2026
• contao Contao: Path traversal in the images controller CVE-2026-107844 Fix available 5.3 MediumOctober 9, 2026
• contao Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check CVE-2026-107843 Fix available 5.3 MediumOctober 9, 2026
• contao Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled CVE-2026-107842 Fix available 5.3 MediumOctober 9, 2026
• contao Contao: Possible path traversal in job download URIs CVE-2026-55825 Fix available 3.1 LowJuly 31, 2026
• contao Contao crawler leaks auth credentials to external hosts CVE-2026-55824 Fix available 2.6 LowJuly 31, 2026
• contao Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module CVE-2026-57232 Fix available 3.1 LowJuly 31, 2026
• contao Contao is vulnerable to cross-site scripting in templates CVE-2025-65961 Fix available 3.3 LowNovember 25, 2025
• contao Contao is vulnerable to remote code execution in template closures CVE-2025-65960 Fix available 6.6 MediumNovember 25, 2025
• contao Contao has improper privilege management for page and article fields CVE-2025-57759 Fix available 4.3 MediumAugust 28, 2025
• contao Contao discloses information in the news module CVE-2025-57757 Fix available 5.3 MediumAugust 28, 2025
• contao Contao discloses sensitive information in the front end search index CVE-2025-57756 Fix available 5.3 MediumAugust 28, 2025
• contao Contao has improper access control in the back end voters CVE-2025-57758 Fix available 4.3 MediumAugust 28, 2025
• contao Contao allows cross-site scripting through SVG uploads CVE-2025-29790 Fix available 4.8 MediumMarch 18, 2025
• contao Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript CVE-2024-45965 6.4 MediumOctober 2, 2024
• contao Insert tag injection via canonical URL in Contao CVE-2024-45612 Fix available 5.3 MediumSeptember 17, 2024
• contao Directory traversal in the file selector widget in contao/core-bundle CVE-2024-45604 Fix available 4.3 MediumSeptember 17, 2024
• contao Remote command execution through file upload in contao/core-bundle CVE-2024-45398 Fix available 8.3 HighSeptember 17, 2024
• contao Contao's remember-me tokens will not be cleared after a password change CVE-2024-30262 Fix available 5.9 MediumApril 9, 2024
• contao Contao possible cookie sharing with external domains while checking protected pages for broken links CVE-2024-28235 Fix available 8.4 HighApril 9, 2024
• contao Contao has insufficient BBCode sanitizer CVE-2024-28234 Fix available 4.3 MediumApril 9, 2024
• contao Contao may have unencoded insert tags in the frontend CVE-2024-28191 Fix available 3.1 LowApril 9, 2024
• contao Contao core bundle vulnerable to cross site scripting in the file manager CVE-2024-28190 Fix available 5.4 MediumApril 9, 2024
• contao Contao Cross-site Scripting vulnerabililty CVE-2018-5478 Fix available 6.1 MediumSeptember 21, 2023
• contao Contao cross site scripting vulnerability via input unit widget CVE-2023-36806 Fix available 6.5 MediumJuly 25, 2023
• contao contao/core-bundle has path traversal vulnerability in the file manager CVE-2023-29200 Fix available 4.3 MediumApril 25, 2023
• contao Cross site scripting via canonical tag CVE-2022-24899 Fix available 7.2 HighMay 5, 2022
• contao Remote Code Execution in Contao Managed Edition CVE-2022-26265 Public exploit EPSS 30.4% 9.8 CriticalMarch 18, 2022
• contao Cross site scripting via HTML attributes in the back end CVE-2021-35955 Fix available 4.8 MediumAugust 12, 2021
• contao Privilege escalation via form generator CVE-2021-37627 Fix available 8.0 HighAugust 11, 2021
• contao PHP file inclusion via insert tags CVE-2021-37626 Fix available 7.2 HighAugust 11, 2021
• contao Cross site scripting in the system log CVE-2021-35210 Fix available 6.1 MediumJune 23, 2021
• contao Contao Insert tag injection in forms CVE-2020-25768 Fix available 5.3 MediumSeptember 24, 2020
• contao Cross-site Scripting in Contao CVE-2018-10125 Fix available 6.1 MediumMarch 16, 2020
• contao Contao core SQL Injection Vulnerability CVE-2012-4383 Fix available 8.8 HighJanuary 29, 2020
• contao cms Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities CVE-2014-1860 9.8 CriticalJanuary 8, 2020
• contao Unrestricted file uploads in Contao CVE-2019-19745 Fix available 8.8 HighDecember 17, 2019
• contao Insert tag injection in the Contao login module CVE-2019-19714 Fix available 5.3 MediumDecember 17, 2019
• contao Information disclosure in the Contao backend CVE-2019-19712 Fix available 5.3 MediumDecember 17, 2019
• contao Contao SQL injection in the file manager CVE-2019-11512 Fix available 9.8 CriticalJuly 9, 2019
• contao cms Contao SQL injection in the backend and listing module CVE-2017-16558 Fix available 9.8 CriticalApril 25, 2019
• contao cms Contao Information Disclosure via Access Control Flaws CVE-2018-20028 Fix available 6.5 MediumApril 17, 2019
• contao cms Contao CSRF Token Bypass CVE-2019-10642 Fix available 8.8 HighApril 17, 2019
• contao cms Contao Does Not Expire Tokens Correctly CVE-2019-10643 Fix available 9.8 CriticalApril 17, 2019
• contao cms Contao Does Not Invalidate Existing Sessions When Password Changes CVE-2019-10641 Fix available 9.8 CriticalApril 17, 2019
• contao cms Contao Core directory traversal vulnerability CVE-2017-10993 Fix available 8.8 HighJuly 21, 2017
• contao cms Contao Core directory traversal vulnerability CVE-2015-0269 Fix available 4.3 MediumMay 26, 2017
• Show olderLoading…