PatchFirst · Latest vulnerabilities
Vulnerabilities published for contao/core in the last 30 days: 0. Listed in the KEV catalogue: 0.
Vulnerabilities: 9
PHP object injection vulnerability was identified in contao/core due to untrusted data being passed to `deserialize()` function.
contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation. In fact, attackers can remove or change pathconfig.php by entering a URL, meaning that the entire Contao installation will no longer be accessible or malicious code can be executed.
Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.
Contao before 4.5.7 has XSS in the system log.
contao prior to 2.11.4 has a sql injection vulnerability
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors.
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
Check your installed stack and versions against the current vulnerability feeds.