616 matches found
CVE-2014-1860
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...
Design/Logic Flaw
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...
CVE-2014-1860
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...
CVE-2014-1860
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...
CVE-2014-1860
CVE-2014-1860 affects Contao CMS up to version 3.2.4, where PHP Object Injection vulnerabilities are reported. The connected zdt entry documents a code execution vulnerability in Contao 3.2.4 and earlier, linked to improper handling of user input that is unserialized, enabling potential arbitrary...
CVE-2014-1860: Deserialization of Untrusted Data
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities...
PT-2020-7610
Name of the Vulnerable Software and Affected Versions Contao CMS versions prior to 3.2.5 Description The issue concerns PHP Object Injection vulnerabilities. Recommendations For Contao CMS versions prior to 3.2.5, update to version 3.2.5 or later to resolve the issue...
Unrestricted File Uploads
Contao is vulnerable to unrestricted file uploads. Back end users with access privileges to the form generator are allowed to upload arbitrary files and execute on the server...
Privilege Escalation
Contao is susceptible to privilege escalation. The attack exists because it lacks the check to control the back end users from accessing details view URL to show restricted pages and articles...
Local File Inclusion
contao/core-bundle is vulnerable to local file inclusion. insert tags can be injected into the login module which will be replaced when the page is rendered. This could potentially allow for arbitrary code execution when an attacker is able to upload a malicious file into the server...
Contao Information Disclosure Vulnerability
Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . An information disclosure vulnerability exists in Contao versions 4.0 to 4.8.5. The vulnerability arises from errors in configuration and other...
Arbitrary File Upload Vulnerability in Contao
Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . A vulnerability exists in Contao versions 4.0 through 4.8.5. An attacker can exploit the vulnerability to upload arbitrary files and execute them o...
Contao Output Improperly Encoded or Escaped Vulnerability
Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. An improper output encoding or escaping vulnerability exists in Contao versions 4.8.4 and 4.8.5. An attacker can exploit this vulnerability by...
Insert tag injection in the Contao login module
Impact It is possible to inject insert tags into the login module which will be replaced when the page is rendered. Patches Update to Contao 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module For more information If you have any...
GHSA-JC43-QRRP-98F5 Insert tag injection in the Contao login module
Impact It is possible to inject insert tags into the login module which will be replaced when the page is rendered. Patches Update to Contao 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module For more information If you have any...
Information disclosure in the Contao backend
Impact Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/information-disclosure-in-the-back-end For more information If...
GHSA-4MVC-QC5W-V5QR Information disclosure in the Contao backend
Impact Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds None. References https://contao.org/en/security-advisories/information-disclosure-in-the-back-end For more information If...
GHSA-WJX8-CGRM-HH8P Unrestricted file uploads in Contao
Impact A back end user with access to the form generator can upload arbitrary files and execute them on the server. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory. References...
Unrestricted file uploads in Contao
Impact A back end user with access to the form generator can upload arbitrary files and execute them on the server. Patches Update to Contao 4.4.46 or 4.8.6. Workarounds Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory. References...