Vulnerabilities

TI-2025-40529 CVE-2025-65961 · GHSA-68q5-78xp-cwwc

Contao is vulnerable to cross-site scripting in templates

LOW 21

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00179 Published 2025-11-25 Fixed in 4.13.57, 5.3.42 +1 CWE-87

TI-2025-40528 CVE-2025-65960 · GHSA-98vj-mm79-v77r

Contao is vulnerable to remote code execution in template closures

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.0019 Published 2025-11-25 Fixed in 4.13.57, 5.3.42 +1 CWE-351

TI-2025-35644 CVE-2025-57759 · GHSA-qqfq-7cpp-hcqj

Contao has improper privilege management for page and article fields

LOW 20

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00257 Published 2025-08-28 Fixed in 5.3.38, 5.6.1 CWE-269

TI-2025-35643 CVE-2025-57758 · GHSA-7m47-r75r-cx8v

Contao has improper access control in the back end voters

LOW 20

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00257 Published 2025-08-28 Fixed in 5.3.38, 5.6.1 CWE-284

TI-2025-35642 CVE-2025-57757 · GHSA-w53m-gxvg-vx7p

Contao discloses information in the news module

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00316 Published 2025-08-28 Fixed in 5.3.38, 5.6.1 CWE-200

TI-2025-35641 CVE-2025-57756 · GHSA-2xmj-8wmq-7475

Contao discloses sensitive information in the front end search index

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00297 Published 2025-08-28 Fixed in 4.13.56, 5.3.38 +1 CWE-200

TI-2025-21201 CVE-2025-29790 · GHSA-vqqr-fgmh-f626

Contao allows cross-site scripting through SVG uploads

LOW 21

Contao is an Open Source CMS.

CVSS 4.0MEDIUM 4.8 Network Low privileges User interaction EPSS 0.00225 Published 2025-03-18 Fixed in 4.13.54, 5.3.30 +1 CWE-79

TI-2024-30849 CVE-2024-45965

Unrestricted file upload in Contao

MEDIUM 62

Contao before 5.5.6 allows XSS via an SVG document.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00338 Published 2024-10-02 Fixed in 4.13.54, 5.3.30 +1 CWE-434

TI-2024-30623 CVE-2024-45604 · GHSA-4p75-5p53-65m9

Directory traversal in the file selector widget in contao/core-bundle

LOW 20

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00427 Published 2024-09-17 Fixed in 4.13.49 CWE-22

TI-2024-30447 CVE-2024-45398 · GHSA-vm6r-j788-hjh5

Remote command execution through file upload in contao/core-bundle

MEDIUM 41

Contao is an Open Source CMS.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00532 Published 2024-09-17 Fixed in 4.13.49, 5.3.15 +1 CWE-434

TI-2024-30631 CVE-2024-45612 · GHSA-2xpq-xp6c-5mgj

Insert tag injection via canonical URL in Contao

LOW 30

Contao is an Open Source CMS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00298 Published 2024-09-17 Fixed in 4.13.49, 5.3.15 +1 CWE-20

TI-2024-20008 CVE-2024-30262 · GHSA-r4r6-j2j3-7pp5

Contao's remember-me tokens will not be cleared after a password change

LOW 32

Contao is an open source content management system.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00551 Published 2024-04-09 Fixed in 4.13.40 CWE-384

TI-2024-18794 CVE-2024-28235 · GHSA-9jh5-qf84-x6pr

Contao possible cookie sharing with external domains while checking protected pages for broken links

LOW 38

Contao is an open source content management system.

CVSS 3.1HIGH 8.4 Network No auth User interaction EPSS 0.00708 Published 2024-04-09 Fixed in 4.13.40, 5.3.4 CWE-200

TI-2024-18793 CVE-2024-28234 · GHSA-j55w-hjpj-825g

Contao has insufficient BBCode sanitizer

LOW 22

Contao is an open source content management system.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00572 Published 2024-04-09 Fixed in 4.13.40, 5.3.4 CWE-74

TI-2024-18767 CVE-2024-28191 · GHSA-747v-52c4-8vj8

Contao may have unencoded insert tags in the frontend

LOW 25

Contao is an open source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00497 Published 2024-04-09 Fixed in 4.13.40, 5.3.4 CWE-74

TI-2024-18766 CVE-2024-28190 · GHSA-v24p-7p4j-qvvf

Contao core bundle vulnerable to cross site scripting in the file manager

LOW 25

Contao is an open source content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00502 Published 2024-04-09 Fixed in 4.13.40, 5.3.4 CWE-79

TI-2018-03988 CVE-2018-5478 · GHSA-mpg7-2rx9-h5qp

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.

LOW 27

Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00415 Published 2023-09-21 Fixed in 3.5.32 CWE-79

TI-2023-18600 CVE-2023-36806 · GHSA-4gpr-p634-922x

Contao cross site scripting vulnerability via input unit widget

MEDIUM 62

Contao is an open source content management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00637 Published 2023-07-25 Fixed in 4.9.42, 4.13.28 +1 CWE-79

TI-2023-13628 CVE-2023-29200 · GHSA-fp7q-xhhw-6rj3

contao/core-bundle has path traversal vulnerability in the file manager

LOW 30

Contao is an open source content management system.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00797 Published 2023-04-25 Fixed in 4.9.40, 4.13.21 +1 CWE-22

TI-2022-08709 CVE-2022-24899 · GHSA-m8x6-6r63-qvj2

Cross site scripting via canonical tag

MEDIUM 45

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.04478 Published 2022-05-05 Fixed in 4.13.3 CWE-79

TI-2022-09661 CVE-2022-26265 · GHSA-rggc-4g3r-j7ff

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE)…

HIGH 66

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.30367 Published 2022-03-18 No fix listed CWE-78

TI-2021-14409 CVE-2021-35955 · GHSA-hr3h-x6gq-rqcp

Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field.

LOW 23

Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00557 Published 2021-08-12 Fixed in 4.4.56, 4.9.18 +1 CWE-79

TI-2021-15502 CVE-2021-37627 · GHSA-hq5m-mqmx-fw6m

Privilege escalation via form generator

LOW 37

Contao is an open source CMS that allows creation of websites and scalable web applications.

CVSS 3.1HIGH 8.0 Network High privileges No interaction EPSS 0.01023 Published 2021-08-11 Fixed in 4.4.56, 4.9.18 +1 CWE-269

TI-2021-15501 CVE-2021-37626 · GHSA-r6mv-ppjc-4hgr

PHP file inclusion via insert tags

LOW 34

Contao is an open source CMS that allows you to create websites and scalable web applications.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01254 Published 2021-08-11 Fixed in 4.4.56, 4.9.18 +1 CWE-94

TI-2021-14104 CVE-2021-35210 · GHSA-h58v-c6rf-g9f7

Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows…

LOW 29

Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0074 Published 2021-06-23 Fixed in 4.9.16, 4.11.5 CWE-79

Vulnerabilities

Filters