编号撤回

Contao is an open source content management system CMS developed using PHP. A cross-site scripting vulnerability exists in versions of Contao prior to 4.13.3, which stems from the application's lack of validation of user input. An attacker could exploit this vulnerability to execute malicious...

PT-2022-13985

Name of the Vulnerable Software and Affected Versions contao/contao versions prior to 4.13.3 Description The issue is related to Cross-site Scripting XSS in the contao/contao GitHub repository. An attacker can execute malicious JavaScript in the application. Recommendations For versions prior to...

PT-2022-16968

Name of the Vulnerable Software and Affected Versions Contao versions prior to 4.13.3 Description The issue allows untrusted users to inject malicious code into the canonical tag, which is then executed on the web page. This can be done in versions of Contao prior to 4.13.3. As a temporary measur...

CVE-2022-24899: Improper Neutralization of Input During Web Page Generation

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings...

GHSA-9JQ2-JVWC-P52F Contao core SQL Injection Vulnerability

Contao core prior to 2.11.4 has a SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php...

Contao core SQL Injection Vulnerability

Contao core prior to 2.11.4 has a SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php...

Remote Code Execution in Contao Managed Edition

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

GHSA-RGGC-4G3R-J7FF Remote Code Execution in Contao Managed Edition

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

CVE-2022-26265

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

CVE-2022-26265

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

CVE-2022-26265

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

Command injection

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

CVE-2022-26265

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

CVE-2022-26265

Summary: CVE-2022-26265 affects Contao Managed Edition v1.5.0 and is a remote command execution (RCE) vulnerability exploitable via the php_cli parameter. The NVD entry documents high/severe scores (CVSS v2 7.5/P), and CVSS v3.1 base score 9.8 (CRITICAL). Public references confirm an RCE vector, ...

CVE-2022-26265

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

PT-2022-17751 · Contao · Contao Managed Edition

Name of the Vulnerable Software and Affected Versions: Contao Managed Edition version 1.5.0 Description: A remote command execution issue was discovered, allowing for potential exploitation via the php cli parameter. This could lead to unauthorized execution of commands. Recommendations: For Cont...

Contao 操作系统命令注入漏洞

Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management, and CSS frameworks. Contao Managed Edition version 1.5.0 suffers from an operating system command injection vulnerability, which stems from a Remote Command Execution...

CVE-2022-26265: Improper Neutralization of Special Elements used in an OS Command

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...

GHSA-V3MR-GP7J-PW5W Possible SQL injection in tablelookupwizard Contao Extension

Impact The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility. Patches The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0. For more information If you have any questions or comments...

Possible SQL injection in tablelookupwizard Contao Extension

Impact The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility. Patches The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0. For more information If you have any questions or comments...