547 matches found
CVE-2017-16558
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module...
CVE-2017-16558
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module...
CVE-2017-16558
CVE-2017-16558 affects Contao up to versions 3.5.30 and 4.4.x (specifically 4.0.0 to 4.4.7) with an SQL injection vulnerability in the backend and in the listing module. The connected documents confirm this vulnerability is in Contao’s file/backend interfaces and that it can be triggered via user...
CVE-2017-16558
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module...
Information Disclosure
contao/contao is vulnerable to information disclosure attacks. The vulnerability exists as it is possible for unauthorized users to view records without proper permissions...
CVE-2018-20028
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
Cross site request forgery (csrf)
Contao 4.7 allows CSRF...
CVE-2019-10643
Contao 4.7 allows Use of a Key Past its Expiration Date...
CVE-2019-10641
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...
Improper access control
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
CVE-2019-10641
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...
Code injection
Contao 4.7 allows Use of a Key Past its Expiration Date...
Default credentials
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password...
CVE-2018-20028
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control...
CVE-2019-10642
Contao 4.7 allows CSRF...
CVE-2019-10642
Contao 4.7 allows CSRF...
CVE-2019-10643
Contao 4.7 allows Use of a Key Past its Expiration Date...
CVE-2018-20028
The CVE-2018-20028 vulnerability affects Contao: 3.x before 3.5.37, 4.4.x before 4.4.31, and 4.6.x before 4.6.11 suffer from Incorrect Access Control that enables viewing records not authorized for the logged-in back end user. The issue allows unauthorized users to view records (e.g., pages, arti...