TI-2014-01453 CVE-2014-1860 · GHSA-f5qp-m2ff-p49c
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities
Priority MEDIUM 48
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities
contao
Records53All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical7CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9
Exploited now
contao records in CISA KEVNo contao vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
11 records in Contao Cms · all components
TI-2019-07939 CVE-2019-10643 · GHSA-j99g-qjvx-995g
Contao 4.7 allows Use of a Key Past its Expiration Date.
Priority MEDIUM 45
Contao 4.7 allows Use of a Key Past its Expiration Date.
TI-2019-07937 CVE-2019-10641 · GHSA-vcgg-hp4r-87gx
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
Priority MEDIUM 45
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
TI-2017-12170 CVE-2017-16558 · GHSA-w38g-hj45-mjjp
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the…
Priority MEDIUM 45
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.
TI-2017-08073 CVE-2017-10993 · GHSA-x5g4-crxq-qxjx
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute…
Priority MEDIUM 43
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.
TI-2019-07938 CVE-2019-10642 · GHSA-hwmh-9jj9-8c9c
Contao 4.7 allows CSRF.
Priority LOW 39
Contao 4.7 allows CSRF.
TI-2012-01169 CVE-2012-1297 · GHSA-c982-gvw7-5x8v
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao…
Priority LOW 32
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) delete…
TI-2018-14206 CVE-2018-20028 · GHSA-q99w-j4mj-7hj8
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control.
Priority LOW 31
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control.
TI-2015-00236 CVE-2015-0269 · GHSA-4r6g-xhx7-fm36
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows…
Priority LOW 24
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors.
TI-2011-00435 CVE-2011-0508 · GHSA-gfg7-fg26-2g7j
Cross-site scripting (XSS) vulnerability in system/modules/comments/Comments.php in…
Priority LOW 24
Cross-site scripting (XSS) vulnerability in system/modules/comments/Comments.php in Contao CMS 2.9.2, and possibly other versions before 2.9.3, allows remote attackers to inject arbitrary web script or HTML via the HTTP…
TI-2011-03800 CVE-2011-4335 · GHSA-cmq8-7f55-mqpv
Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote…
Priority LOW 23
Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php in a (1) teachers.html or (2) teachers/ action.