CVE-2017-10993

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal...

CVE-2017-10993

CVE-2017-10993 covers a directory traversal in Contao before 3.5.28 and 4.x before 4.4.1. A remote attacker can include and execute arbitrary local PHP files by manipulating a crafted URL parameter. This vulnerability enables remote code execution on affected Contao installations. The issue is do...

CVE-2017-10993

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal...

CVE-2017-10993: Improper Limitation of a Pathname to a Restricted Directory

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal...

A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter

More info at https://contao.org/en/news/contao-441.html...

PHP file inclusion in the back end

Date : 2017-07-12 CVE ID : CVE-2017-10993 Description A logged in back end user can include arbitrary PHP files by manipulating an URL parameter. Since Contao does not allow to upload PHP files in the file manager, the attack is limited to the existing PHP files on the server. Affected versions...

Contao Directory Traversal Vulnerability

Contao is an open source content management system CMS developed using PHP. The system supports search engine , rights management and CSS framework . A directory traversal vulnerability exists in Contao versions prior to 3.2.19 and 3.4.x prior to 3.4.4. A remote attacker can exploit this...

CVE-2015-0269

Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors...

Directory traversal

Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors...

CVE-2015-0269

Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors...

CVE-2015-0269

Contao CVE-2015-0269 is a directory traversal vulnerability in Contao CMS where remote authenticated backend users could view files outside their allowed mounts. Affected versions include Contao 3.* up to 3.4.3 and 3.2.x prior to 3.2.19; the issue arises in the back end and allows access to files...

CVE-2015-0269: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors...

PT-2017-6443

Name of the Vulnerable Software and Affected Versions Contao versions prior to 3.2.19 Contao versions 3.4.x prior to 3.4.4 Description A directory traversal issue allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors...

Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2 (see CVE-2013-1967)

More info at https://contao.org/en/news/contao-3515.html...

Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2 (see CVE-2013-1967)

More info at https://contao.org/en/news/contao-3515.html...

Cross-site scripting (XSS) vulnerability in flashmediaelement.swf in MediaElement.js before 2.11.2 (see CVE-2013-1967)

More info at https://contao.org/en/news/contao-3515.html...

Directory traversal in the back end

Date : 2015-02-12 CVE ID : CVE-2015-0269 Description Arnaud Buchoux with Orange Consulting has discovered a directory traversal vulnerability, which allows logged in back end users to view files outside their file mounts or the document root. It is, however, not possible to edit these files or to...

Insufficient input validation allows for code injection and remote execution

More info at https://contao.org/en/news/new-security-hole-found-in-contao.html...

PHP object injection vulnerability allows for arbitrary code execution

More info at https://contao.org/en/news/major-security-hole-found-in-contao.html...

Contao CMS 3.2.4 Code Execution Vulnerability

Contao CMS versions 3.2.4 and below suffer from a code execution vulnerability. Hi, I have discovered a vulnerability that might lead to code execution in Contao CMS Vulnerabilities in Contao 3.2.4 Discovered by Pedro Ribeiro email protected of Agile Information Security...