545 matches found
Design/Logic Flaw
Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them...
CVE-2019-19714
Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the page is rendered...
CVE-2019-19714
Contao CVE-2019-19714 affects Contao CMS 4.8.4 and 4.8.5, where improper encoding/escaping in the login module allows injection of insert tags that are replaced during page rendering. This is due to insufficient output encoding in the login module, with the advised remediation to upgrade to Conta...
CVE-2019-19712
Contao CMS vulnerability CVE-2019-19712 affects Contao 4.0–4.8.5 where backend users can manipulate the details view URL to reveal pages/articles not enabled for them, indicating an information-disclosure issue due to insecure permissions in the backend. Affected versions include 4.0 through 4.8....
CVE-2019-19712
Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them...
Information disclosure in the back end
Date : 2019-12-17 CVE ID : CVE-2019-19712 Description Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Affected versions Contao 4.0 Contao 4.1 Contao 4.2 Contao 4.3 Contao 4.4 up to 4.4.45 Contao 4.5 Contao 4.6 Contao 4.7 Contao 4....
Unrestricted file uploads
Date : 2019-12-17 CVE ID : CVE-2019-19745 Description A back end user with access to the form generator can upload arbitrary files and execute them on the server. Affected versions Contao 4.0 Contao 4.1 Contao 4.2 Contao 4.3 Contao 4.4 up to 4.4.45 Contao 4.5 Contao 4.6 Contao 4.7 Contao 4.8 up t...
Insert tag injection in the login module
Date : 2019-12-17 CVE ID : CVE-2019-19714 Description It is possible to inject insert tags into the login module which will be replaced when the page is rendered. Affected versions Contao 4.8.4 and 4.8.5 Suggested solution Update to Contao 4.8.6...
SQL Injection
contao/core-bundle is vulnerable to SQL injection. The vulnerability exists in the value of strField in the file manager search filter, which allows a remote attacker to inject and execute arbitrary SQL queries through the affected parameter...
CVE-2019-11512
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...
CVE-2019-11512
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...
Sql injection
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...
CVE-2019-11512
CVE-2019-11512 describes an SQL injection in Contao 4.x, exploitable via the file manager. Affected versions span Contao 4.1 through 4.7.4, with exposure up to 4.4.38. The issue is fixed in Contao 4.4.39 and 4.7.5 (as confirmed by multiple sources). Red Hat notes the same fixed versions; other ad...
CVE-2019-11512
Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5...
Contao SQL Injection Vulnerability
Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . Contao has a SQL injection vulnerability that can be exploited by attackers to execute illegal SQL commands...
SQL injection in the file manager
Date : 2019-04-30 CVE ID : CVE-2019-11512 Description David Wind, penetration tester with A1 Digital, has discovered that the SQL injection vulnerability originally published under CVE-2017-16558 can still be exploited in the file manager in Contao 4. The security vulnerability has the identifier...
CVE-2017-16558
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module...
CVE-2017-16558
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module...