CVE-2018-20028
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control.
- Update to 3.5.37
- Update to 4.4.31
- Update to 4.6.11
Published Updated
PatchFirst · Latest vulnerabilities
contao/contao vulnerabilities · Page 2
Vulnerabilities published for contao/contao in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 25
CVE-2019-10642
Contao 4.7 allows CSRF.
- Update to 4.7.3
Published UpdatedCVE-2019-10643
Contao 4.7 allows Use of a Key Past its Expiration Date.
- Update to 4.7.3
Published UpdatedCVE-2019-10641
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
- Update to 4.4.37
- Update to 4.7.3
Published UpdatedCVE-2017-10993
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.
- Update to 4.4.1
Published Updated
Check your server
Check your installed stack and versions against the current vulnerability feeds.