| 0 |
| url |
VCID-2w7m-mb7e-tqe6 |
| vulnerability_id |
VCID-2w7m-mb7e-tqe6 |
| summary |
Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads
Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-29790, GHSA-vqqr-fgmh-f626
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2w7m-mb7e-tqe6 |
|
| 1 |
| url |
VCID-afma-748j-uqae |
| vulnerability_id |
VCID-afma-748j-uqae |
| summary |
Contao can disclose sensitive information in the news module
If a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-57757, GHSA-w53m-gxvg-vx7p
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-afma-748j-uqae |
|
| 2 |
| url |
VCID-f1az-1ejn-53f7 |
| vulnerability_id |
VCID-f1az-1ejn-53f7 |
| summary |
Contao discloses sensitive information in the front end search index
Protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-57756, GHSA-2xmj-8wmq-7475
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-f1az-1ejn-53f7 |
|
| 3 |
| url |
VCID-f8ny-db5g-pkhw |
| vulnerability_id |
VCID-f8ny-db5g-pkhw |
| summary |
Contao affected by remote command execution through file upload
Back end users with access to the file manager can upload malicious files and execute them on the server. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://github.com/contao/contao |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/contao/contao |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2024-45398, GHSA-vm6r-j788-hjh5
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-f8ny-db5g-pkhw |
|
| 4 |
| url |
VCID-gwea-1srz-9uca |
| vulnerability_id |
VCID-gwea-1srz-9uca |
| summary |
Contao affected by insert tag injection via canonical URL
It is possible to inject insert tags in canonical URLs which will be replaced when the page is rendered. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://github.com/contao/contao |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/contao/contao |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2024-45612, GHSA-2xpq-xp6c-5mgj
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gwea-1srz-9uca |
|
| 5 |
| url |
VCID-gzzh-6ysu-9yey |
| vulnerability_id |
VCID-gzzh-6ysu-9yey |
| summary |
Contao: Possible cookie sharing with external domains while checking protected pages for broken links
If the crawler is set to crawl protected pages, it sends the cookie header to externals URLs. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-28235, GHSA-9jh5-qf84-x6pr
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gzzh-6ysu-9yey |
|
| 6 |
| url |
VCID-jbcs-b2p9-myhz |
| vulnerability_id |
VCID-jbcs-b2p9-myhz |
| summary |
Contao: Cross site scripting in the file manager
Users can insert malicious code into file names when uploading files, which is then executed in tooltips and popups in the backend. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-28190, GHSA-v24p-7p4j-qvvf
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jbcs-b2p9-myhz |
|
| 7 |
| url |
VCID-jzx2-et8q-7qhm |
| vulnerability_id |
VCID-jzx2-et8q-7qhm |
| summary |
Contao: Unencoded insert tags in the frontend
It is possible to inject insert tags via the form generator if the submitted form data is output on the page in a specific way. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2024-28191, GHSA-747v-52c4-8vj8
|
| risk_score |
1.4 |
| exploitability |
0.5 |
| weighted_severity |
2.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jzx2-et8q-7qhm |
|
| 8 |
| url |
VCID-p4tq-y4en-57ag |
| vulnerability_id |
VCID-p4tq-y4en-57ag |
| summary |
Contao does not properly manage privileges for page and article fields
Under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-57759, GHSA-qqfq-7cpp-hcqj
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-p4tq-y4en-57ag |
|
| 9 |
| url |
VCID-r1h5-ag74-dbaw |
| vulnerability_id |
VCID-r1h5-ag74-dbaw |
| summary |
Contao is vulnerable to cross-site scripting in templates
It is possible to inject code into the template output that will be executed in the browser in the front end and back end. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-65961, GHSA-68q5-78xp-cwwc
|
| risk_score |
1.5 |
| exploitability |
0.5 |
| weighted_severity |
3.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-r1h5-ag74-dbaw |
|
| 10 |
| url |
VCID-wyd5-t8at-8bba |
| vulnerability_id |
VCID-wyd5-t8at-8bba |
| summary |
Contao is vulnerable to remote code execution in template closures
Backend users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-65960, GHSA-98vj-mm79-v77r
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wyd5-t8at-8bba |
|
| 11 |
| url |
VCID-ycnh-mnst-duap |
| vulnerability_id |
VCID-ycnh-mnst-duap |
| summary |
Contao applies improper access control in the back end voters
The table access voter in the back end doesn't check if a user is allowed to access the corresponding module. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2025-57758, GHSA-7m47-r75r-cx8v
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ycnh-mnst-duap |
|