# cve.now: Contao

The newest entries naming Contao as an affected vendor (up to 200), of 32 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-107851](https://cve.now/CVE-2026-107851.md): Contao: Improper access control in the table access voter (CVSS 4.3)
- [CVE-2026-107850](https://cve.now/CVE-2026-107850.md): Contao: Improper access control in the preview links module (CVSS 4.3)
- [CVE-2026-107848](https://cve.now/CVE-2026-107848.md): Contao: Cross-site request forgery in custom backend actions (CVSS 3.5)
- [CVE-2026-107845](https://cve.now/CVE-2026-107845.md): Contao: Cross-site scripting in the comments bundle (CVSS 9.3)
- [CVE-2026-107844](https://cve.now/CVE-2026-107844.md): Contao: Path traversal in the images controller (CVSS 5.3)
- [CVE-2026-107843](https://cve.now/CVE-2026-107843.md): Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check (CVSS 5.3)
- [CVE-2026-107842](https://cve.now/CVE-2026-107842.md): Contao: Protected page content is disclosed to anonymous visitors after contao.search.index\_protected is disabled (CVSS 5.3)
- [CVE-2026-55825](https://cve.now/CVE-2026-55825.md): Contao: Possible path traversal in job download URIs (CVSS 3.1)
- [CVE-2026-55824](https://cve.now/CVE-2026-55824.md): Contao crawler leaks auth credentials to external hosts (CVSS 2.6)
- [CVE-2026-57232](https://cve.now/CVE-2026-57232.md): Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module (CVSS 3.1)
- [CVE-2025-65961](https://cve.now/CVE-2025-65961.md): Contao is vulnerable to cross-site scripting in templates (CVSS 3.3)
- [CVE-2025-65960](https://cve.now/CVE-2025-65960.md): Contao is vulnerable to remote code execution in template closures (CVSS 6.6)
- [CVE-2025-57759](https://cve.now/CVE-2025-57759.md): Contao has improper privilege management for page and article fields (CVSS 4.3)
- [CVE-2025-57758](https://cve.now/CVE-2025-57758.md): Contao has improper access control in the back end voters (CVSS 4.3)
- [CVE-2025-57757](https://cve.now/CVE-2025-57757.md): Contao discloses information in the news module (CVSS 5.3)
- [CVE-2025-57756](https://cve.now/CVE-2025-57756.md): Contao discloses sensitive information in the front end search index (CVSS 5.3)
- [CVE-2025-29790](https://cve.now/CVE-2025-29790.md): Contao allows cross-site scripting through SVG uploads (CVSS 4.8)
- [CVE-2024-45965](https://cve.now/CVE-2024-45965.md): Contao before 5.5.6 allows XSS via an SVG document. (CVSS 6.4)
- [CVE-2024-45604](https://cve.now/CVE-2024-45604.md): Directory traversal in the file selector widget in contao/core-bundle (CVSS 4.3)
- [CVE-2024-45398](https://cve.now/CVE-2024-45398.md): Remote command execution through file upload in contao/core-bundle (CVSS 8.3)
- [CVE-2024-45612](https://cve.now/CVE-2024-45612.md): Insert tag injection via canonical URL in Contao (CVSS 5.3)
- [CVE-2024-30262](https://cve.now/CVE-2024-30262.md): Contao's remember-me tokens will not be cleared after a password change (CVSS 5.9)
- [CVE-2024-28235](https://cve.now/CVE-2024-28235.md): Contao possible cookie sharing with external domains while checking protected pages for broken links (CVSS 8.4)
- [CVE-2024-28234](https://cve.now/CVE-2024-28234.md): Contao has insufficient BBCode sanitizer (CVSS 4.3)
- [CVE-2024-28191](https://cve.now/CVE-2024-28191.md): Contao may have unencoded insert tags in the frontend (CVSS 3.1)
- [CVE-2024-28190](https://cve.now/CVE-2024-28190.md): Contao core bundle vulnerable to cross site scripting in the file manager (CVSS 5.4)
- [CVE-2023-36806](https://cve.now/CVE-2023-36806.md): Contao cross site scripting vulnerability via input unit widget (CVSS 6.5)
- [CVE-2023-29200](https://cve.now/CVE-2023-29200.md): contao/core-bundle has path traversal vulnerability in the file manager (CVSS 4.3)
- [CVE-2022-24899](https://cve.now/CVE-2022-24899.md): Cross site scripting via canonical tag (CVSS 7.2)
- [CVE-2021-37627](https://cve.now/CVE-2021-37627.md): Privilege escalation via form generator (CVSS 8.0)
- [CVE-2021-37626](https://cve.now/CVE-2021-37626.md): PHP file inclusion via insert tags (CVSS 7.2)
- [CVE-2012-4383](https://cve.now/CVE-2012-4383.md): contao prior to 2.11.4 has a sql injection vulnerability (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/contao
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.