VulnerableCode Package Details - pkg:composer/contao/core@3.5.33

Staging Environment: Content and features may be unstable or change without notice.

Search for packages

Package details: pkg:composer/contao/core@3.5.33

Essentials
History (3)

purl	pkg:composer/contao/core@3.5.33

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk

Vulnerabilities affecting this package (3)

Vulnerability	Summary	Fixed by
VCID-5kwa-7kx3-kfga Aliases: CVE-2019-10641 GHSA-vcgg-hp4r-87gx	Weak Password Recovery Mechanism for Forgotten Password Contao has a Weak Password Recovery Mechanism for a Forgotten Password.	3.5.39 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-6um8-6hqz-uybm Aliases: CVE-2017-16558 GHSA-w38g-hj45-mjjp	SQL injection vulnerability Both the search filter in the back end and the "listing" module in the front end are vulnerable to SQL injection. To exploit the vulnerability in the back end, a back end user has to be logged in, whereas the front end vulnerability can be exploited by anyone.	There are no reported fixed by versions.
VCID-epmj-qf23-xffd Aliases: CVE-2018-10125 GHSA-pj4j-287j-f742	XSS in system log of back end There's a Cross-Site Scripting (XSS) vulnerability in system log of back end. With a manipulated request, an attacker can implant a script which is executed when a logged in back end user opens the system log. The attacker themselves does not have to be logged in.	3.5.35 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-06-04T20:21:12.172666+00:00	GitLab Importer	Affected by	VCID-6um8-6hqz-uybm	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/contao/core/CVE-2017-16558.yml	38.6.0
2026-06-04T20:20:55.428234+00:00	GitLab Importer	Affected by	VCID-5kwa-7kx3-kfga	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/contao/core/CVE-2019-10641.yml	38.6.0
2026-06-04T20:11:53.084562+00:00	GitLab Importer	Affected by	VCID-epmj-qf23-xffd	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/contao/core/CVE-2018-10125.yml	38.6.0