547 matches found
Cross site scripting via canonical URL
More info at https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html...
编号撤回
Contao is an open source content management system CMS developed using PHP. A cross-site scripting vulnerability exists in versions of Contao prior to 4.13.3, which stems from the application's lack of validation of user input. An attacker could exploit this vulnerability to execute malicious...
Cross site scripting via canonical URL
Date : 2022-05-05 CVE ID : CVE-2022-24899 Description Untrusted users can inject malicious code into the canonical tag, which is then executed on the web page front end. Affected versions Contao 4.13 up to 4.13.2 Suggested solution Update to Contao 4.13.3. Workaround Disable canonical tags in the...
Contao 跨站脚本漏洞
Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. A security vulnerability exists in Contao versions 4.13.0 through 4.13.3 and earlier, which allows untrusted users to inject malicious code into...
Contao core SQL Injection Vulnerability
Contao core prior to 2.11.4 has a SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php...
GHSA-9JQ2-JVWC-P52F Contao core SQL Injection Vulnerability
Contao core prior to 2.11.4 has a SQL injection vulnerability in contao-2.11.3\system\modules\backend\Ajax.php...
Remote Code Execution in Contao Managed Edition
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...
GHSA-RGGC-4G3R-J7FF Remote Code Execution in Contao Managed Edition
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...
CVE-2022-26265
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...
CVE-2022-26265
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...
CVE-2022-26265
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...
Command injection
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...
CVE-2022-26265
Summary: CVE-2022-26265 affects Contao Managed Edition v1.5.0 and is a remote command execution (RCE) vulnerability exploitable via the php_cli parameter. The NVD entry documents high/severe scores (CVSS v2 7.5/P), and CVSS v3.1 base score 9.8 (CRITICAL). Public references confirm an RCE vector, ...
CVE-2022-26265
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution RCE vulnerability via the component phpcli parameter...
Contao 操作系统命令注入漏洞
Contao is an open source content management system CMS developed using PHP. The system supports search engines, rights management, and CSS frameworks. Contao Managed Edition version 1.5.0 suffers from an operating system command injection vulnerability, which stems from a Remote Command Execution...
PT-2022-17751 · Contao · Contao Managed Edition
Name of the Vulnerable Software and Affected Versions: Contao Managed Edition version 1.5.0 Description: A remote command execution issue was discovered, allowing for potential exploitation via the php cli parameter. This could lead to unauthorized execution of commands. Recommendations: For Cont...
Possible SQL injection in tablelookupwizard Contao Extension
Impact The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility. Patches The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0. For more information If you have any questions or comments...
GHSA-V3MR-GP7J-PW5W Possible SQL injection in tablelookupwizard Contao Extension
Impact The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility. Patches The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0. For more information If you have any questions or comments...