545 matches found
CVE-2023-29200
Summary: CVE-2023-29200 is a directory traversal vulnerability in Contao’s file manager (core-bundle). Prior to versions 4.9.40, 4.13.21, and 5.1.4, authenticated back-end users could trigger an Ajax request to list arbitrary files outside the document root. Some sources state that file contents ...
CVE-2023-29200 contao/core-bundle has path traversal vulnerability in the file manager
Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao...
Directory traversal in the file manager
Date : 2023-04-25 CVE ID : CVE-2023-29200 Authenticated users in the back end can list files outside the document root in the file manager. However, it is not possible to read the contents of these files. Thanks to Daniel Barros for reporting the problem. Affected versions Contao 4.0 Contao 4.1...
Contao 路径遍历漏洞
Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. A path traversal vulnerability exists in Contao versions prior to 4.9.40, 4.13.21, and 5.1.4. An attacker exploiting this vulnerability could list...
PT-2023-22197 · Contao · Contao
Name of the Vulnerable Software and Affected Versions: Contao versions prior to 4.9.40 Contao versions prior to 4.13.21 Contao versions prior to 5.1.4 Description: Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary...
Exploit for OS Command Injection in Contao
CVE-2022-26265 The first proof of c...
Exploit for OS Command Injection in Contao
CVE-2022-26265 Contao CMS RCE This repo is part of the h...
Exploit for OS Command Injection in Contao
CVE-2022-26265 Contao CMS RCE This repo is part of the h...
Contao 4.13.2 Cross Site Scripting
Exploit Title: Contao 4.13.2 - Cross-Site Scripting XSS Google Dork: NA Date: 04/28/2022 Exploit Author: Chetanya Sharma @AggressiveUser Vendor Homepage: https://contao.org/en/ Software Link: https://github.com/contao/contao/releases/tag/4.13.2 Version: 4.13.2 Tested on: KALI OS CVE : CVE-2022-15...
Contao 4.13.2 - Cross-Site Scripting Vulnerability
Exploit Title: Contao 4.13.2 - Cross-Site Scripting XSS Exploit Author: Chetanya Sharma @AggressiveUser Vendor Homepage: https://contao.org/en/ Software Link: https://github.com/contao/contao/releases/tag/4.13.2 Version: 4.13.2 Tested on: KALI OS CVE : CVE-2022-1588 References: -...
Contao 4.13.2 - Cross-Site Scripting (XSS)
Exploit Title: Contao 4.13.2 - Cross-Site Scripting XSS Google Dork: NA Date: 04/28/2022 Exploit Author: Chetanya Sharma @AggressiveUser Vendor Homepage: https://contao.org/en/ Software Link: https://github.com/contao/contao/releases/tag/4.13.2 Version: 4.13.2 Tested on: KALI OS CVE : CVE-2022-15...
GHSA-VQ59-X6MQ-4WGW Contao SQL injection in the file manager
David Wind, penetration tester with A1 Digital, has discovered that the SQL injection vulnerability originally published under CVE-2017-16558 can still be exploited in the file manager in Contao 4...
Contao SQL injection in the file manager
David Wind, penetration tester with A1 Digital, has discovered that the SQL injection vulnerability originally published under CVE-2017-16558 can still be exploited in the file manager in Contao 4...
GHSA-W38G-HJ45-MJJP Contao SQL injection in the backend and listing module
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the backend as well as in the listing module...
Contao SQL injection in the backend and listing module
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the backend as well as in the listing module...
GHSA-M8X6-6R63-QVJ2 Cross site scripting via canonical tag in Contao
Impact Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page front end. Patches Update to Contao 4.13.3. Workarounds Disable canonical tags in the root page settings. References...
Cross site scripting via canonical tag in Contao
Impact Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page front end. Patches Update to Contao 4.13.3. Workarounds Disable canonical tags in the root page settings. References...
GHSA-4R6G-XHX7-FM36 Contao Core directory traversal vulnerability
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated backend users to view files outside their file mounts or the document root via unspecified vectors...
Contao Core directory traversal vulnerability
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated backend users to view files outside their file mounts or the document root via unspecified vectors...