616 matches found
Contao Information Disclosure via Access Control Flaws
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
GHSA-Q99W-J4MJ-7HJ8 Contao Information Disclosure via Access Control Flaws
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
GHSA-J99G-QJVX-995G Contao Does Not Expire Tokens Correctly
Security researcher Ali Razzaq has discovered that confirming an opt-in token does not invalidate previous opt-in tokens in Contao 4.7...
Contao Does Not Expire Tokens Correctly
Security researcher Ali Razzaq has discovered that confirming an opt-in token does not invalidate previous opt-in tokens in Contao 4.7...
Cross-site Scripting (XSS)
contao/core-bundle is vulnerable to cross-site scriptingXSS attacks. The library does not properly sanitize the user inputs through the canonical tag, allowing an attacker to inject and execute malicious javascript...
Contao Cross-Site Scripting Vulnerability (CNVD-2022-36995)
Contao is an open source content management system CMS developed using PHP. A cross-site scripting vulnerability exists in versions of Contao prior to 4.13.3, which stems from the application's lack of validation of user input. An attacker could exploit this vulnerability to execute malicious...
Cross-site Scripting (XSS)
contao/core-bundle is vulnerable to cross-site scripting. The vulnerability exists in the prepare function of PageRegular.php, allowing an attacker to inject and execute malicious javascript through the canonical tags...
CVE-2022-24899
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings...
Code injection
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings...
CVE-2022-24899
Summary of CVE-2022-24899 : Contao prior to version 4.13.3 contains a cross-site scripting vulnerability that allows injection of arbitrary JavaScript into the canonical tag. Exploitation leads to JavaScript execution in a victim’s browser on the front end, with potential for data theft or web pa...
CVE-2022-24899 Cross site scripting via canonical tag
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings...
CVE-2022-24899 Cross site scripting via canonical tag
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings...
CVE-2022-24899 Cross site scripting via canonical tag
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings...
Cross site scripting via canonical URL
More info at https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html...
Cross site scripting via canonical URL
Date : 2022-05-05 CVE ID : CVE-2022-24899 Description Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page front end. Affected versions Contao 4.13 up to 4.13.2 Suggested solution Update to Contao 4.13.3. Workaround Disable canonical tags in the...
编号撤回
Contao is an open source content management system CMS developed using PHP. A cross-site scripting vulnerability exists in versions of Contao prior to 4.13.3, which stems from the application's lack of validation of user input. An attacker could exploit this vulnerability to execute malicious...
CVE-2022-24899: Improper Neutralization of Input During Web Page Generation
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings...
Contao 跨站脚本漏洞
Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. A security vulnerability exists in Contao versions 4.13.0 through 4.13.3 and earlier, which allows untrusted users to inject malicious code into...