PatchFirst · Vulnérabilités récentes
Vulnérabilité publiée pour contao/core au cours des 30 derniers jours : 0. Dans le catalogue KEV : 0.
Vulnérabilités : 9
PHP object injection vulnerability was identified in contao/core due to untrusted data being passed to `deserialize()` function.
contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation. In fact, attackers can remove or change pathconfig.php by entering a URL, meaning that the entire Contao installation will no longer be accessible or malicious code can be executed.
Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.
Contao before 4.5.7 has XSS in the system log.
contao prior to 2.11.4 has a sql injection vulnerability
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors.
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.