# contao/core (Packagist) vulnerabilities

7 known vulnerabilities, with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/contao/core

## Advisories (7)

### [CVE-2018-5478](https://cve.now/CVE-2018-5478): Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.

- Severity: Unrated
- Published: Sep 21, 2023
- Affected: from 3.0.0, fixed in 3.5.32.

### [CVE-2018-10125](https://cve.now/CVE-2018-10125): Contao before 4.5.7 has XSS in the system log.

- Severity: Unrated
- Published: Mar 16, 2020
- Affected: from 3.0.0, fixed in 3.5.35.

### [CVE-2012-4383](https://cve.now/CVE-2012-4383): contao prior to 2.11.4 has a sql injection vulnerability

- Severity: Unrated
- Published: Jan 29, 2020
- Affected: fixed in 2.11.4.

### [CVE-2019-10641](https://cve.now/CVE-2019-10641): Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.

- Severity: Unrated
- Published: Apr 17, 2019
- Affected: from 3.0.0, fixed in 3.5.39.

### [CVE-2017-10993](https://cve.now/CVE-2017-10993): Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter…

- Severity: Unrated
- Published: Jul 21, 2017
- Affected: from 3.0.0, fixed in 3.5.28.

### [CVE-2015-0269](https://cve.now/CVE-2015-0269): Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view…

- Severity: Unrated
- Published: May 26, 2017
- Affected: from 3.4.0, fixed in 3.4.4; from 2.0.0, fixed in 3.2.19.

### [CVE-2016-4567](https://cve.now/CVE-2016-4567): Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before…

- Severity: Unrated
- Published: May 22, 2016
- Affected: from 3.0.0, fixed in 3.5.15.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/contao/core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.