11 matches found
CVE-2019-19712
Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them...
Unrestricted Upload Of File With Dangerous Type
Contao is vulnerable to Unrestricted Upload of File with Dangerous Type. The vulnerability is caused due to a lack of proper validation and security controls in the file upload functionality, allowing malicious users to upload and execute harmful files on the server, which may lead to Remote Code...
Contao: Possible cookie sharing with external domains while checking protected pages for broken links
Impact If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs. Patches Update to Contao 4.13.40 or 5.3.4. Workarounds Disable crawling protected pages. References https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler For more...
Cross site scripting via canonical URL
More info at https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html...
CVE-2021-35210
Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tllog table that will be executed in the browser when the system log is called in the back end...
Sql injection
contao prior to 2.11.4 has a sql injection vulnerability...
Cross-site scripting (XSS) vulnerability in the system log of the back end
More info at https://contao.org/en/news/contao-3535.html...
PHP object injection vulnerability allows for arbitrary code execution
More info at https://contao.org/en/news/major-security-hole-found-in-contao.html...
PHP file inclusion via insert tags
More info at https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags.html...
PHP file inclusion via insert tags
More info at https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags.html...
Insert tag injection in front end forms
More info at https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html...