CVE-2020-25768

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered...

CVE-2020-25768: Improper Input Validation

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered...

GHSA-F7WM-X4GW-6M23 Contao Insert tag injection in forms

Impact It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. Patches Update to Contao 4.4.52, 4.9.6 or 4.10.1. Workarounds Disable the front end login form and do not use form fields with array keys such as fieldname. References...

Contao Insert tag injection in forms

Impact It is possible to inject insert tags in front end forms which will be replaced when the page is rendered. Patches Update to Contao 4.4.52, 4.9.6 or 4.10.1. Workarounds Disable the front end login form and do not use form fields with array keys such as fieldname. References...

PT-2020-16192

Name of the Vulnerable Software and Affected Versions Contao versions 4.4.0 through 4.4.51 Contao versions 4.9.0 through 4.9.5 Contao versions 4.10.0 through 4.10.0 Description The issue is related to Improper Input Validation, allowing the injection of insert tags in front end forms. These tags...

Contao Cross-Site Scripting Vulnerability

Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . A cross-site scripting vulnerability exists in Contao versions prior to 4.5.7, which stems from a lack of proper validation of client-side data by...

CVE-2018-10125

Contao before 4.5.7 has XSS in the system log...

CVE-2018-10125

Contao before 4.5.7 has XSS in the system log...

Design/Logic Flaw

Contao before 4.5.7 has XSS in the system log...

CVE-2018-10125

Contao before 4.5.7 has XSS in the system log...

CVE-2018-10125

The CVE-2018-10125 entry describes a Cross-site Scripting (XSS) vulnerability in Contao before version 4.5.7, specifically in the system log. The root cause appears to be insufficient validation of client-side data in the web application, enabling an attacker to inject malicious scripts that may ...

CVE-2018-10125

Contao before 4.5.7 has XSS in the system log...

PT-2020-8512

Name of the Vulnerable Software and Affected Versions: Contao versions prior to 4.5.7 Description: The issue is related to Cross-Site Scripting XSS in the system log. XSS is a type of security vulnerability that allows an attacker to inject malicious scripts into a website, potentially leading to...

CVE-2018-10125: Improper Neutralization of Input During Web Page Generation

Contao before 4.5.7 has XSS in the system log...

CVE-2012-4383

contao prior to 2.11.4 has a sql injection vulnerability...

Sql injection

contao prior to 2.11.4 has a sql injection vulnerability...

CVE-2012-4383

contao prior to 2.11.4 has a sql injection vulnerability...

CVE-2012-4383

CVE-2012-4383 affects Contao core prior to 2.11.4, with an SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php. The Red Hat/GHSA/osv entries confirm this issue in the Contao core and identify 2.11.4 as the fixed version. The connected documents do not detail exploit metho...

CVE-2012-4383

contao prior to 2.11.4 has a sql injection vulnerability...

PT-2020-7233

Name of the Vulnerable Software and Affected Versions Contao versions prior to 2.11.4 Description The issue is a SQL injection vulnerability. It affects the Contao core, specifically in the contao-2.11.3systemmodulesbackendAjax.php file. Recommendations For versions prior to 2.11.4, update to...