contao

Records53All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical7CVSS 9.0–10.0

CVSS high10CVSS 7.0–8.9

Exploited now

contao records in CISA KEV

No contao vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Contao 32 records HIGH Contao Cms 11 records MEDIUM

Records

32 records in Contao · all components

TI-2022-09661 CVE-2022-26265 · GHSA-rggc-4g3r-j7ff

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE)…

HIGH 66

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.30367 Published 2022-03-18 No fix listed CWE-78

TI-2024-30849 CVE-2024-45965

Unrestricted file upload in Contao

MEDIUM 62

Contao before 5.5.6 allows XSS via an SVG document.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00338 Published 2024-10-02 Fixed in 4.13.54, 5.3.30 +1 CWE-434

TI-2023-18600 CVE-2023-36806 · GHSA-4gpr-p634-922x

Contao cross site scripting vulnerability via input unit widget

MEDIUM 62

Contao is an open source content management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00637 Published 2023-07-25 Fixed in 4.9.42, 4.13.28 +1 CWE-79

TI-2022-08709 CVE-2022-24899 · GHSA-m8x6-6r63-qvj2

Cross site scripting via canonical tag

MEDIUM 45

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.04478 Published 2022-05-05 Fixed in 4.13.3 CWE-79

TI-2019-08602 CVE-2019-11512 · GHSA-vq59-x6mq-4wgw

Contao 4.x allows SQL Injection.

MEDIUM 45

Contao 4.x allows SQL Injection.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01462 Published 2019-07-09 Fixed in 4.4.39, 4.7.5 CWE-89

TI-2024-30447 CVE-2024-45398 · GHSA-vm6r-j788-hjh5

Remote command execution through file upload in contao/core-bundle

MEDIUM 41

Contao is an Open Source CMS.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00532 Published 2024-09-17 Fixed in 4.13.49, 5.3.15 +1 CWE-434

TI-2019-14229 CVE-2019-19745 · GHSA-wjx8-cgrm-hh8p

Contao 4.0 through 4.8.5 allows PHP local file inclusion.

MEDIUM 40

Contao 4.0 through 4.8.5 allows PHP local file inclusion.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01108 Published 2019-12-17 Fixed in 4.4.46, 4.8.6 CWE-434

TI-2012-03726 CVE-2012-4383 · GHSA-9jq2-jvwc-p52f

contao prior to 2.11.4 has a sql injection vulnerability

MEDIUM 40

contao prior to 2.11.4 has a sql injection vulnerability

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00919 Published 2020-01-29 Fixed in 2.11, 2.11.4 CWE-89

TI-2024-18794 CVE-2024-28235 · GHSA-9jh5-qf84-x6pr

Contao possible cookie sharing with external domains while checking protected pages for broken links

LOW 38

Contao is an open source content management system.

CVSS 3.1HIGH 8.4 Network No auth User interaction EPSS 0.00708 Published 2024-04-09 Fixed in 4.13.40, 5.3.4 CWE-200

TI-2021-15502 CVE-2021-37627 · GHSA-hq5m-mqmx-fw6m

Privilege escalation via form generator

LOW 37

Contao is an open source CMS that allows creation of websites and scalable web applications.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.01023 Published 2021-08-11 Fixed in 4.4.56, 4.9.18 +1 CWE-269

TI-2021-15501 CVE-2021-37626 · GHSA-r6mv-ppjc-4hgr

PHP file inclusion via insert tags

LOW 34

Contao is an open source CMS that allows you to create websites and scalable web applications.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01254 Published 2021-08-11 Fixed in 4.4.56, 4.9.18 +1 CWE-94

TI-2024-20008 CVE-2024-30262 · GHSA-r4r6-j2j3-7pp5

Contao's remember-me tokens will not be cleared after a password change

LOW 32

Contao is an open source content management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00551 Published 2024-04-09 Fixed in 4.13.40 CWE-384

TI-2025-40528 CVE-2025-65960 · GHSA-98vj-mm79-v77r

Contao is vulnerable to remote code execution in template closures

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.0019 Published 2025-11-25 Fixed in 4.13.57, 5.3.42 +1 CWE-351

TI-2025-35642 CVE-2025-57757 · GHSA-w53m-gxvg-vx7p

Contao discloses information in the news module

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00316 Published 2025-08-28 Fixed in 5.3.38, 5.6.1 CWE-200

TI-2025-35641 CVE-2025-57756 · GHSA-2xmj-8wmq-7475

Contao discloses sensitive information in the front end search index

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00297 Published 2025-08-28 Fixed in 4.13.56, 5.3.38 +1 CWE-200

TI-2024-30631 CVE-2024-45612 · GHSA-2xpq-xp6c-5mgj

Insert tag injection via canonical URL in Contao

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00298 Published 2024-09-17 Fixed in 4.13.49, 5.3.15 +1 CWE-20

TI-2023-13628 CVE-2023-29200 · GHSA-fp7q-xhhw-6rj3

contao/core-bundle has path traversal vulnerability in the file manager

LOW 30

Contao is an open source content management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00797 Published 2023-04-25 Fixed in 4.9.40, 4.13.21 +1 CWE-22

TI-2021-14104 CVE-2021-35210 · GHSA-h58v-c6rf-g9f7

Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows…

LOW 29

Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0074 Published 2021-06-23 Fixed in 4.9.16, 4.11.5 CWE-79

TI-2018-07186 CVE-2018-10125 · GHSA-pj4j-287j-f742

Contao before 4.5.7 has XSS in the system log.

LOW 29

Contao before 4.5.7 has XSS in the system log.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00839 Published 2020-03-16 Fixed in 4.4.18, 4.5.8 +1 CWE-79

TI-2018-03988 CVE-2018-5478 · GHSA-mpg7-2rx9-h5qp

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.

LOW 27

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00415 Published 2023-09-21 Fixed in 3.5.32 CWE-79

TI-2020-15776 CVE-2020-25768 · GHSA-f7wm-x4gw-6m23

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input…

LOW 26

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00819 Published 2020-10-07 Fixed in 4.4.52, 4.9.6 +1 CWE-20

TI-2019-14205 CVE-2019-19714 · GHSA-jc43-qrrp-98f5

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output.

LOW 26

Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00819 Published 2019-12-17 Fixed in 4.8.6 CWE-116

TI-2019-14204 CVE-2019-19712 · GHSA-4mvc-qc5w-v5qr

Contao 4.0 through 4.8.5 has Insecure Permissions.

LOW 26

Contao 4.0 through 4.8.5 has Insecure Permissions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.0088 Published 2019-12-17 Fixed in 4.4.46, 4.8.6 CWE-276

TI-2024-18767 CVE-2024-28191 · GHSA-747v-52c4-8vj8

Contao may have unencoded insert tags in the frontend

LOW 25

Contao is an open source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00497 Published 2024-04-09 Fixed in 4.13.40, 5.3.4 CWE-74

TI-2024-18766 CVE-2024-28190 · GHSA-v24p-7p4j-qvvf

Contao core bundle vulnerable to cross site scripting in the file manager

LOW 25

Contao is an open source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00502 Published 2024-04-09 Fixed in 4.13.40, 5.3.4 CWE-79

Open these records in search →