CVE-2014-9433: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in cms/frontcontent.php in Contenido before 4.9.6, when advanced mod rewrite AMR is disabled, allow remote attackers to inject arbitrary web script or HTML via the 1 idart, 2 lang, or 3 idcat parameter...

CVE-2006-5380: Undefined Security Weakness

Remote file inclusion vulnerability in Contenido CMS allows remote attackers to execute arbitrary PHP code via a URL in the contenidopath parameter to 1 cms/dbfs.php or 2 cms/frontcontent.php. NOTE: CVE disputes this issue for version 4.6.15, because $contenidopath is set to a static value...