Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

contao/core

7 known vulnerabilities, with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7
Registry
Packagist

Advisories 7

  • Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.

    Affected: from 3.0.0, fixed in 3.5.32.

  • Contao before 4.5.7 has XSS in the system log.

    Affected: from 3.0.0, fixed in 3.5.35.

  • contao prior to 2.11.4 has a sql injection vulnerability

    Affected: fixed in 2.11.4.

  • Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.

    Affected: from 3.0.0, fixed in 3.5.39.

  • Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter…

    Affected: from 3.0.0, fixed in 3.5.28.

  • Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view…

    Affected: from 3.4.0, fixed in 3.4.4; from 2.0.0, fixed in 3.2.19.

  • Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before…

    Affected: from 3.0.0, fixed in 3.5.15.