EUVD-2020-1014

🗓️ 07 Oct 2025 00:30:54Reported by EUVDType

Contao versions have improper input validation allowing tag injection in front end forms.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2020-25768	8 Oct 202000:29	–	circl
Contao	Insert tag injection in forms	24 Sep 202000:00	–	contao
CVE	CVE-2020-25768	7 Oct 202020:37	–	cve
Cvelist	CVE-2020-25768	7 Oct 202020:37	–	cvelist
Friends Of PHP	Insert tag injection in front end forms	1 Jan 197000:00	–	friendsofphp
Friends Of PHP	Insert tag injection in front end forms	1 Jan 197000:00	–	friendsofphp
Github Security Blog	Contao Insert tag injection in forms	24 Sep 202016:23	–	github
NVD	CVE-2020-25768	7 Oct 202021:15	–	nvd
OSV	GHSA-F7WM-X4GW-6M23 Contao Insert tag injection in forms	24 Sep 202016:23	–	osv
Prion	Input validation	7 Oct 202021:15	–	prion

[
  {
    "enisaIdVendor": [
      {
        "id": "65c4b8de-ace6-3b7c-9196-b5bddde06f1a",
        "vendor": {
          "name": "n/a"
        }
      }
    ],
    "enisaIdProduct": [
      {
        "id": "30cce12a-804f-347b-82c4-2d491fbd4d33",
        "product": {
          "name": "n/a"
        },
        "product_version": "n/a"
      }
    ]
  }
]

Source	Link
github	www.github.com/contao/contao/security/advisories/GHSA-f7wm-x4gw-6m23
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-25768
community	www.community.contao.org/en/forumdisplay.php
contao	www.contao.org/en/security-advisories/insert-tag-injection-in-forms.html
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2020-25768.yaml
github	www.github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2020-25768.yaml
github	www.github.com/contao/contao
github	www.github.com/advisories/GHSA-293c-r3p4-g63r

07 Oct 2025 00:30Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.15.3

CVSS 25

EPSS0.0031

contao security vulnerability input validation tag injection front end forms