Priority HIGH 66
Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.30367 · Published 2022-03-18 · No fix listed CWE-78
Priority MEDIUM 62
Contao before 5.5.6 allows XSS via an SVG document.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00338 · Published 2024-10-02 · Fixed in 4.13.54, 5.3.30 +1 CWE-434
Priority MEDIUM 62
Contao is an open source content management system.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · User interaction · EPSS 0.00637 · Published 2023-07-25 · Fixed in 4.9.42, 4.13.28 +1 CWE-79
Priority MEDIUM 48
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03648 · Published 2020-01-08 · No fix listed CWE-502
Priority MEDIUM 45
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications.
CVSS 3.1HIGH 7.2· Network · No auth · No interaction · EPSS 0.04478 · Published 2022-05-05 · Fixed in 4.13.3 CWE-79
Priority MEDIUM 45
Contao 4.x allows SQL Injection.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01462 · Published 2019-07-09 · Fixed in 4.4.39, 4.7.5 CWE-89
Priority MEDIUM 45
Contao 4.7 allows Use of a Key Past its Expiration Date.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01254 · Published 2019-04-17 · Fixed in 4.7.3 CWE-287
Priority MEDIUM 45
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.0134 · Published 2019-04-17 · Fixed in 4.4.37, 4.7.3 +1 CWE-640
Priority MEDIUM 45
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01506 · Published 2019-04-25 · Fixed in 4.4.8 CWE-89
Priority MEDIUM 43
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.02722 · Published 2017-07-21 · Fixed in 4.4.1, 3.5.28 CWE-22
Priority MEDIUM 42
Contao is an Open Source CMS.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00277 · Published 2026-10-09 · Fixed in 5.3.50, 5.7.12 CWE-116
Priority MEDIUM 41
Contao is an Open Source CMS.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00532 · Published 2024-09-17 · Fixed in 4.13.49, 5.3.15 +1 CWE-434
Priority MEDIUM 40
Contao 4.0 through 4.8.5 allows PHP local file inclusion.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01108 · Published 2019-12-17 · Fixed in 4.4.46, 4.8.6 CWE-434
Priority MEDIUM 40
contao prior to 2.11.4 has a sql injection vulnerability
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00919 · Published 2020-01-29 · Fixed in 2.11, 2.11.4 CWE-89
Priority LOW 39
Contao 4.7 allows CSRF.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00499 · Published 2019-04-17 · Fixed in 4.7.3 CWE-352
Priority LOW 38
Contao is an open source content management system.
CVSS 3.1HIGH 8.4· Network · No auth · User interaction · EPSS 0.00708 · Published 2024-04-09 · Fixed in 4.13.40, 5.3.4 CWE-200
Priority LOW 37
Contao is an open source CMS that allows creation of websites and scalable web applications.
CVSS 3.1HIGH 8.0· Network · High privileges · No interaction · EPSS 0.01023 · Published 2021-08-11 · Fixed in 4.4.56, 4.9.18 +1 CWE-269
Priority LOW 34
Contao is an open source CMS that allows you to create websites and scalable web applications.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01254 · Published 2021-08-11 · Fixed in 4.4.56, 4.9.18 +1 CWE-94
Priority LOW 32
Contao is an open source content management system.
CVSS 3.1HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00551 · Published 2024-04-09 · Fixed in 4.13.40 CWE-384
Priority LOW 32
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.01022 · Published 2012-03-19 · No fix listed CWE-352
Priority LOW 31
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00906 · Published 2019-04-17 · Fixed in 3.5.37, 4.6.11 +1 CWE-284
Priority LOW 30
Contao is an Open Source CMS.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00312 · Published 2026-10-09 · Fixed in 5.3.50, 5.7.12 CWE-22
Priority LOW 30
Contao is an Open Source CMS.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0027 · Published 2026-10-09 · Fixed in 5.3.50, 5.7.12 CWE-204
Priority LOW 30
Contao is an Open Source CMS.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00262 · Published 2026-10-09 · Fixed in 5.3.50, 5.7.12 CWE-200
Priority LOW 30
Contao is an Open Source CMS.
CVSS 3.1MEDIUM 6.6· Network · High privileges · No interaction · EPSS 0.0019 · Published 2025-11-25 · Fixed in 4.13.57, 5.3.42 +1 CWE-351
Load more
THREATIST.IORead the docs