CVE-2020-25768

CVE-2020-25768 (Contao) involves improper input validation that allows insertion of insert tags in front-end forms, which are later rendered as part of the page. Affected products/versions include Contao prior to 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1. The underlying issue is inject...

CVE-2020-25768

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered...

GHSA-F7WM-X4GW-6M23 Contao Insert tag injection in forms

Impact It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. Patches Update to Contao 4.4.52, 4.9.6 or 4.10.1. Workarounds Disable the front end login form and do not use form fields with array keys such as fieldname. References...

Contao Insert tag injection in forms

Impact It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. Patches Update to Contao 4.4.52, 4.9.6 or 4.10.1. Workarounds Disable the front end login form and do not use form fields with array keys such as fieldname. References...

Contao Cross-Site Scripting Vulnerability

Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . A cross-site scripting vulnerability exists in Contao versions prior to 4.5.7, which stems from a lack of proper validation of client-side data by...

CVE-2018-10125

Contao before 4.5.7 has XSS in the system log...

CVE-2018-10125

Contao before 4.5.7 has XSS in the system log...

Design/Logic Flaw

Contao before 4.5.7 has XSS in the system log...

CVE-2018-10125

Contao before 4.5.7 has XSS in the system log...

CVE-2018-10125

The CVE-2018-10125 entry describes a Cross-site Scripting (XSS) vulnerability in Contao before version 4.5.7, specifically in the system log. The root cause appears to be insufficient validation of client-side data in the web application, enabling an attacker to inject malicious scripts that may ...

CVE-2012-4383

contao prior to 2.11.4 has a sql injection vulnerability...

Sql injection

contao prior to 2.11.4 has a sql injection vulnerability...

CVE-2012-4383

contao prior to 2.11.4 has a sql injection vulnerability...

CVE-2012-4383

CVE-2012-4383 affects Contao core prior to 2.11.4, with an SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php. The Red Hat/GHSA/osv entries confirm this issue in the Contao core and identify 2.11.4 as the fixed version. The connected documents do not detail exploit metho...

CVE-2014-1860

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...

Design/Logic Flaw

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...

CVE-2014-1860

CVE-2014-1860 affects Contao CMS up to version 3.2.4, where PHP Object Injection vulnerabilities are reported. The connected zdt entry documents a code execution vulnerability in Contao 3.2.4 and earlier, linked to improper handling of user input that is unserialized, enabling potential arbitrary...

CVE-2014-1860

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...

Unrestricted File Uploads

Contao is vulnerable to unrestricted file uploads. Back end users with access privileges to the form generator are allowed to upload arbitrary files and execute on the server...

Privilege Escalation

Contao is susceptible to privilege escalation. The attack exists because it lacks the check to control the back end users from accessing details view URL to show restricted pages and articles...