547 matches found
CVE-2021-37626
Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify...
CVE-2021-37627
Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in the Contao back end. Installations are only affected if they have untrusted back end users who have access to the form generator. All users...
CVE-2022-24899
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings...
CVE-2024-45398
Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does...
Cross-site Scripting (XSS)
Contao is vulnerable to stored Cross-site Scripting XSS. The vulnerability is due to improper validation of SVG file uploads, allowing an authenticated admin to upload a file containing malicious JavaScript that can be executed when accessed through the website...
GHSA-MRW8-5368-PHM3 Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vqqr-fgmh-f626. This link is maintained to preserve external references. Original Description Contao 5.4.1 allows an authenticated admin account to upload a SVG file containing malicious javascript code into the...
Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-vqqr-fgmh-f626. This link is maintained to preserve external references. Original Description Contao 5.4.1 allows an authenticated admin account to upload a SVG file containing malicious javascript code into the...
CVE-2024-45965
Contao before 5.5.6 allows XSS via an SVG document. This affects in contao/core-bundle in Composer 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6...
CVE-2024-45965
Contao before 5.5.6 allows XSS via an SVG document. This affects in contao/core-bundle in Composer 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6...
Contao 代码问题漏洞
Contao is an open source Content Management System CMS developed in PHP by Contao Open Source. The system supports search engines, rights management and CSS frameworks. A security vulnerability exists in Contao version 5.4.1. The vulnerability is exploited by attackers to perform cross-site...
CVE-2024-45965
Contao before 5.5.6 allows XSS via an SVG document. This affects in contao/core-bundle in Composer 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6...
CVE-2024-45965
Contao before 5.5.6 allows XSS via an SVG document. This affects in contao/core-bundle in Composer 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6...
PT-2024-31859
Name of the Vulnerable Software and Affected Versions Contao version 5.4.1 Description The issue allows an authenticated admin account to upload a SVG file containing malicious javascript code into the target system. If the file is accessed through the website, it could lead to a Cross-Site...
CVE-2024-45965
CVE-2024-45965 — Contao SVG upload XSS : The vulnerability affects Contao Core Bundle via SVG uploads, enabling stored XSS when an attacker (or authenticated admin) uploads a crafted SVG. Affected versions are: 4.x prior to 4.13.54; 5.0.x–5.3.x prior to 5.3.30; and 5.4.x and 5.5.x prior to 5.5.6....
CVE-2024-47069
CVE-2024-47069 affects the Oveleon contao-cookiebar extension for Contao CMS. The vulnerability is in the block/locale endpoint where user-controlled locale input is not properly sanitized before being echoed in the backend HTTP response, causing reflected XSS. Affected versions are before 1.16.3...
CVE-2024-47069 Oveleon Cookiebar reflected Cross-site Scripting vulnerability
Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the...
CVE-2024-47069 Oveleon Cookiebar reflected Cross-site Scripting vulnerability
Oveleon Cookie Bar is a cookie bar is for the Contao Open Source CMS and allows a visitor to define cookie & privacy settings for the website. Prior to versions 1.16.3 and 2.1.3, the block/locale endpoint does not properly sanitize the user-controlled locale input before including it in the...
Cookie Bar 跨站脚本漏洞
Cookie Bar is an Oveleon open source application for Contao. It allows visitors to define cookies and privacy settings for a website. Cookie Bar suffers from a cross-site scripting vulnerability that stems from the block/locale port not properly clearing the locale parameter, leading to reflected...
Improper Input Validation
Contao is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation and sanitization of user input in the canonical tag, allowing untrusted users to inject insert tags that are then rendered on the web page...
Unrestricted Upload Of File With Dangerous Type
Contao is vulnerable to Unrestricted Upload of File with Dangerous Type. The vulnerability is caused due to a lack of proper validation and security controls in the file upload functionality, allowing malicious users to upload and execute harmful files on the server, which may lead to Remote Code...