545 matches found
Local File Inclusion
contao/core-bundle is vulnerable to local file inclusion. insert tags can be injected into the login module which will be replaced when the page is rendered. This could potentially allow for arbitrary code execution when an attacker is able to upload a malicious file into the server...
Contao Information Disclosure Vulnerability
Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . An information disclosure vulnerability exists in Contao versions 4.0 to 4.8.5. The vulnerability arises from errors in configuration and other...
Contao Output Improperly Encoded or Escaped Vulnerability
Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. An improper output encoding or escaping vulnerability exists in Contao versions 4.8.4 and 4.8.5. An attacker can exploit this vulnerability by...
Arbitrary File Upload Vulnerability in Contao
Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . A vulnerability exists in Contao versions 4.0 through 4.8.5. An attacker can exploit the vulnerability to upload arbitrary files and execute them o...
Insert tag injection in the Contao login module
Impact It is possible to inject insert tags into the login module which will be replaced when the page is rendered. Patches Update to Contao 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module For more information If you have any...
GHSA-JC43-QRRP-98F5 Insert tag injection in the Contao login module
Impact It is possible to inject insert tags into the login module which will be replaced when the page is rendered. Patches Update to Contao 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module For more information If you have any...
Information disclosure in the Contao backend
Impact Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/information-disclosure-in-the-back-end For more information If...
GHSA-4MVC-QC5W-V5QR Information disclosure in the Contao backend
Impact Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/information-disclosure-in-the-back-end For more information If...
GHSA-WJX8-CGRM-HH8P Unrestricted file uploads in Contao
Impact A back end user with access to the form generator can upload arbitrary files and execute them on the server. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory. References...
Unrestricted file uploads in Contao
Impact A back end user with access to the form generator can upload arbitrary files and execute them on the server. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory. References...
CVE-2019-19714
Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered...
CVE-2019-19714
Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered...
CVE-2019-19745
Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server...
CVE-2019-19745
Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server...
Design/Logic Flaw
Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered...
Design/Logic Flaw
Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server...
CVE-2019-19745
Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server...
CVE-2019-19745
Contao 4.x (4.0–4.8.5) is affected by an unrestricted file upload flaw that enables a back-end user with access to the form generator to upload arbitrary files and execute them on the server due to PHP local file inclusion. The vulnerability is documented across multiple sources (e.g., RH/CVE-201...