编号撤回

Contao is an open source content management system CMS developed using PHP. A cross-site scripting vulnerability exists in versions of Contao prior to 4.13.3, which stems from the application's lack of validation of user input. An attacker could exploit this vulnerability to execute malicious...

Contao 跨站脚本漏洞

Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. A security vulnerability exists in Contao versions 4.13.0 through 4.13.3 and earlier, which allows untrusted users to inject malicious code into...

Contao core SQL Injection Vulnerability

Contao core prior to 2.11.4 has a SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php...

GHSA-9JQ2-JVWC-P52F Contao core SQL Injection Vulnerability

Contao core prior to 2.11.4 has a SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php...

Remote Code Execution in Contao Managed Edition

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

GHSA-RGGC-4G3R-J7FF Remote Code Execution in Contao Managed Edition

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

CVE-2022-26265

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

CVE-2022-26265

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

CVE-2022-26265

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

Command injection

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

CVE-2022-26265

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

CVE-2022-26265

Summary: CVE-2022-26265 affects Contao Managed Edition v1.5.0 and is a remote command execution (RCE) vulnerability exploitable via the php_cli parameter. The NVD entry documents high/severe scores (CVSS v2 7.5/P), and CVSS v3.1 base score 9.8 (CRITICAL). Public references confirm an RCE vector, ...

Contao 操作系统命令注入漏洞

Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management, and CSS frameworks. Contao Managed Edition version 1.5.0 suffers from an operating system command injection vulnerability, which stems from a Remote Command Execution...

PT-2022-17751 · Contao · Contao Managed Edition

Name of the Vulnerable Software and Affected Versions: Contao Managed Edition version 1.5.0 Description: A remote command execution issue was discovered, allowing for potential exploitation via the php cli parameter. This could lead to unauthorized execution of commands. Recommendations: For Cont...

Possible SQL injection in tablelookupwizard Contao Extension

Impact The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility. Patches The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0. For more information If you have any questions or comments...

GHSA-V3MR-GP7J-PW5W Possible SQL injection in tablelookupwizard Contao Extension

Impact The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility. Patches The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0. For more information If you have any questions or comments...

GHSA-PJ4J-287J-F742 Cross-site Scripting in Contao

Contao before 4.5.7 has XSS in the system log...

Cross-site Scripting in Contao

Contao before 4.5.7 has XSS in the system log...

The vulnerability of the Contao content management system, related to improper code generation, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Contao content management system is related to improper handling of code generation. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information by downloading specially created PHP...

Cross site scripting via HTML attributes in the back end

Impact It is possible for untrusted users to inject malicious code into HTML attributes in the back end, which will be executed both in the element preview back end and on the website front end. Installations are only affected if there are untrusted back end users who have the rights to modify HT...