545 matches found
CVE-2017-16558
CVE-2017-16558 affects Contao up to versions 3.5.30 and 4.4.x (specifically 4.0.0 to 4.4.7) with an SQL injection vulnerability in the backend and in the listing module. The connected documents confirm this vulnerability is in Contao’s file/backend interfaces and that it can be triggered via user...
CVE-2017-16558
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module...
Information Disclosure
contao/contao is vulnerable to information disclosure attacks. The vulnerability exists as it is possible for unauthorized users to view records without proper permissions...
Cross site request forgery (csrf)
Contao 4.7 allows CSRF...
CVE-2018-20028
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
CVE-2019-10643
Contao 4.7 allows Use of a Key Past its Expiration Date...
CVE-2019-10641
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...
CVE-2019-10641
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...
Improper access control
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
CVE-2019-10642
Contao 4.7 allows CSRF...
CVE-2019-10643
Contao 4.7 allows Use of a Key Past its Expiration Date...
Default credentials
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...
Code injection
Contao 4.7 allows Use of a Key Past its Expiration Date...
CVE-2018-20028
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
CVE-2019-10642
Contao 4.7 allows CSRF...
CVE-2018-20028
The CVE-2018-20028 vulnerability affects Contao: 3.x before 3.5.37, 4.4.x before 4.4.31, and 4.6.x before 4.6.11 suffer from Incorrect Access Control that enables viewing records not authorized for the logged-in back end user. The issue allows unauthorized users to view records (e.g., pages, arti...
CVE-2018-20028
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
CVE-2019-10642
Contao 4.7 allows CSRF...
CVE-2019-10642
Contao 4.7 is affected by a CSRF token check bypass (CSRF vulnerability). Multiple connected advisories (GHSA-HWMH-9JJ9-8C9C, OSV/GHSA-...) describe that the request token verification can be bypassed, enabling unauthorized actions within Contao 4.7. The CVE entry CVE-2019-10642 explicitly states...