Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:composer/contao/core-bundle@4.4.16
Typecomposer
Namespacecontao
Namecore-bundle
Version4.4.16
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version4.4.52
Latest_non_vulnerable_version5.6.5
Affected_by_vulnerabilities
0
url VCID-3fux-z15d-13g1
vulnerability_id VCID-3fux-z15d-13g1
summary Contao allows SQL Injection.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-11512
reference_id
reference_type
scores
0
value 0.00307
scoring_system epss
scoring_elements 0.542
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-11512
1
reference_url https://contao.org/en/news/security-vulnerability-cve-2019-11512.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://contao.org/en/news/security-vulnerability-cve-2019-11512.html
2
reference_url https://github.com/contao/contao/commit/87d92f823b08b91a0aeb522284537c8afcdb8aba
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao/commit/87d92f823b08b91a0aeb522284537c8afcdb8aba
3
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-11512.yaml
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-11512.yaml
4
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-11512.yaml
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-11512.yaml
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-11512
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-11512
fixed_packages
0
url pkg:composer/contao/core-bundle@4.4.39
purl pkg:composer/contao/core-bundle@4.4.39
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98fv-kpqs-mybc
1
vulnerability VCID-ah8s-8q49-8qbw
2
vulnerability VCID-u6sk-25yd-e7b2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.4.39
1
url pkg:composer/contao/core-bundle@4.7.5
purl pkg:composer/contao/core-bundle@4.7.5
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-98fv-kpqs-mybc
1
vulnerability VCID-ah8s-8q49-8qbw
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.7.5
aliases CVE-2019-11512, GHSA-vq59-x6mq-4wgw
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-3fux-z15d-13g1
1
url VCID-4rrm-u81m-7kdt
vulnerability_id VCID-4rrm-u81m-7kdt
summary 
Direct Request (Forced Browsing)
Contao has Incorrect Access Control.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-20028
reference_id
reference_type
scores
0
value 0.0027
scoring_system epss
scoring_elements 0.5066
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-20028
1
reference_url https://contao.org/en/news.html
reference_id
reference_type
scores
url https://contao.org/en/news.html
2
reference_url https://contao.org/en/news/security-vulnerability-cve-2018-20028.html
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://contao.org/en/news/security-vulnerability-cve-2018-20028.html
3
reference_url https://github.com/contao/contao/commit/bbe5fe1d385cd1195670e2d6b972272133443c59
reference_id
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao/commit/bbe5fe1d385cd1195670e2d6b972272133443c59
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-20028
reference_id CVE-2018-20028
reference_type
scores
0
value 6.5
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-20028
5
reference_url https://github.com/advisories/GHSA-q99w-j4mj-7hj8
reference_id GHSA-q99w-j4mj-7hj8
reference_type
scores
url https://github.com/advisories/GHSA-q99w-j4mj-7hj8
fixed_packages
0
url pkg:composer/contao/core-bundle@4.4.31
purl pkg:composer/contao/core-bundle@4.4.31
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fux-z15d-13g1
1
vulnerability VCID-5kwa-7kx3-kfga
2
vulnerability VCID-98fv-kpqs-mybc
3
vulnerability VCID-ah8s-8q49-8qbw
4
vulnerability VCID-u6sk-25yd-e7b2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.4.31
1
url pkg:composer/contao/core-bundle@4.6.11
purl pkg:composer/contao/core-bundle@4.6.11
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fux-z15d-13g1
1
vulnerability VCID-5kwa-7kx3-kfga
2
vulnerability VCID-98fv-kpqs-mybc
3
vulnerability VCID-ah8s-8q49-8qbw
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.6.11
aliases CVE-2018-20028, GHSA-q99w-j4mj-7hj8
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-4rrm-u81m-7kdt
2
url VCID-5kwa-7kx3-kfga
vulnerability_id VCID-5kwa-7kx3-kfga
summary 
Weak Password Recovery Mechanism for Forgotten Password
Contao has a Weak Password Recovery Mechanism for a Forgotten Password.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-10641
reference_id
reference_type
scores
0
value 0.00266
scoring_system epss
scoring_elements 0.50287
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-10641
1
reference_url https://contao.org/en/news/security-vulnerability-cve-2019-10641.html
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://contao.org/en/news/security-vulnerability-cve-2019-10641.html
2
reference_url https://github.com/contao/contao/commit/74c7dfafa0dfa5363a9463b486522d5d526e28fe
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao/commit/74c7dfafa0dfa5363a9463b486522d5d526e28fe
3
reference_url https://github.com/contao/contao/commit/b92e27bc7c9e59226077937f840c74ffd0f672e8
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao/commit/b92e27bc7c9e59226077937f840c74ffd0f672e8
4
reference_url https://github.com/contao/core/commit/119a1b5bd9e62d27ca2838727084d04f3b7fcd32
reference_id
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/contao/core/commit/119a1b5bd9e62d27ca2838727084d04f3b7fcd32
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-10641
reference_id CVE-2019-10641
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-10641
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-10641.yaml
reference_id CVE-2019-10641.YAML
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-10641.yaml
7
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-10641.yaml
reference_id CVE-2019-10641.YAML
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-10641.yaml
8
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2019-10641.yaml
reference_id CVE-2019-10641.YAML
reference_type
scores
0
value 9.8
scoring_system cvssv3.1
scoring_elements CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
1
value CRITICAL
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2019-10641.yaml
9
reference_url https://github.com/advisories/GHSA-vcgg-hp4r-87gx
reference_id GHSA-vcgg-hp4r-87gx
reference_type
scores
url https://github.com/advisories/GHSA-vcgg-hp4r-87gx
fixed_packages
0
url pkg:composer/contao/core-bundle@4.4.37
purl pkg:composer/contao/core-bundle@4.4.37
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fux-z15d-13g1
1
vulnerability VCID-98fv-kpqs-mybc
2
vulnerability VCID-ah8s-8q49-8qbw
3
vulnerability VCID-u6sk-25yd-e7b2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.4.37
1
url pkg:composer/contao/core-bundle@4.7.3
purl pkg:composer/contao/core-bundle@4.7.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fux-z15d-13g1
1
vulnerability VCID-98fv-kpqs-mybc
2
vulnerability VCID-ah8s-8q49-8qbw
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.7.3
aliases CVE-2019-10641, GHSA-vcgg-hp4r-87gx
risk_score 4.5
exploitability 0.5
weighted_severity 9.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-5kwa-7kx3-kfga
3
url VCID-98fv-kpqs-mybc
vulnerability_id VCID-98fv-kpqs-mybc
summary 
Unrestricted Upload of File with Dangerous Type
Contao allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-19745
reference_id
reference_type
scores
0
value 0.00452
scoring_system epss
scoring_elements 0.64064
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-19745
1
reference_url https://contao.org/en/news.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://contao.org/en/news.html
2
reference_url https://contao.org/en/security-advisories/unrestricted-file-uploads.html
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://contao.org/en/security-advisories/unrestricted-file-uploads.html
3
reference_url https://github.com/contao/contao
reference_id
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-19745
reference_id CVE-2019-19745
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-19745
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19745.yaml
reference_id CVE-2019-19745.YAML
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19745.yaml
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19745.yaml
reference_id CVE-2019-19745.YAML
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19745.yaml
7
reference_url https://github.com/advisories/GHSA-wjx8-cgrm-hh8p
reference_id GHSA-wjx8-cgrm-hh8p
reference_type
scores
url https://github.com/advisories/GHSA-wjx8-cgrm-hh8p
8
reference_url https://github.com/contao/contao/security/advisories/GHSA-wjx8-cgrm-hh8p
reference_id GHSA-wjx8-cgrm-hh8p
reference_type
scores
0
value 8.8
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
1
value HIGH
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao/security/advisories/GHSA-wjx8-cgrm-hh8p
fixed_packages
0
url pkg:composer/contao/core-bundle@4.4.46
purl pkg:composer/contao/core-bundle@4.4.46
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-u6sk-25yd-e7b2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.4.46
1
url pkg:composer/contao/core-bundle@4.5.0-RC1
purl pkg:composer/contao/core-bundle@4.5.0-RC1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.5.0-RC1
2
url pkg:composer/contao/core-bundle@4.8.6
purl pkg:composer/contao/core-bundle@4.8.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.8.6
3
url pkg:composer/contao/core-bundle@5.5.4
purl pkg:composer/contao/core-bundle@5.5.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@5.5.4
aliases CVE-2019-19745, GHSA-wjx8-cgrm-hh8p
risk_score 4.0
exploitability 0.5
weighted_severity 8.0
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-98fv-kpqs-mybc
4
url VCID-ah8s-8q49-8qbw
vulnerability_id VCID-ah8s-8q49-8qbw
summary 
Incorrect Default Permissions
Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for them.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-19712
reference_id
reference_type
scores
0
value 0.00133
scoring_system epss
scoring_elements 0.32448
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-19712
1
reference_url https://contao.org/en/news.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://contao.org/en/news.html
2
reference_url https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html
3
reference_url https://github.com/contao/contao
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-19712
reference_id CVE-2019-19712
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2019-19712
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19712.yaml
reference_id CVE-2019-19712.YAML
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2019-19712.yaml
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19712.yaml
reference_id CVE-2019-19712.YAML
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19712.yaml
7
reference_url https://github.com/advisories/GHSA-4mvc-qc5w-v5qr
reference_id GHSA-4mvc-qc5w-v5qr
reference_type
scores
url https://github.com/advisories/GHSA-4mvc-qc5w-v5qr
8
reference_url https://github.com/contao/contao/security/advisories/GHSA-4mvc-qc5w-v5qr
reference_id GHSA-4mvc-qc5w-v5qr
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao/security/advisories/GHSA-4mvc-qc5w-v5qr
fixed_packages
0
url pkg:composer/contao/core-bundle@4.4.46
purl pkg:composer/contao/core-bundle@4.4.46
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-u6sk-25yd-e7b2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.4.46
1
url pkg:composer/contao/core-bundle@4.5.0-RC1
purl pkg:composer/contao/core-bundle@4.5.0-RC1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.5.0-RC1
2
url pkg:composer/contao/core-bundle@4.8.6
purl pkg:composer/contao/core-bundle@4.8.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.8.6
3
url pkg:composer/contao/core-bundle@5.5.4
purl pkg:composer/contao/core-bundle@5.5.4
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@5.5.4
aliases CVE-2019-19712, GHSA-4mvc-qc5w-v5qr
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ah8s-8q49-8qbw
5
url VCID-epmj-qf23-xffd
vulnerability_id VCID-epmj-qf23-xffd
summary 
XSS in system log of back end
There's a Cross-Site Scripting (XSS) vulnerability in system log of back end. With a manipulated request, an attacker can implant a script which is executed when a logged in back end user opens the system log. The attacker themselves does not have to be logged in.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-10125
reference_id
reference_type
scores
0
value 0.00328
scoring_system epss
scoring_elements 0.56045
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-10125
1
reference_url https://contao.org/en/news/contao-3_5_35.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://contao.org/en/news/contao-3_5_35.html
2
reference_url https://contao.org/en/news/contao-4_4_18.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://contao.org/en/news/contao-4_4_18.html
3
reference_url https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log.html
reference_id
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log.html
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-10125
reference_id CVE-2018-10125
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2018-10125
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2018-10125.yaml
reference_id CVE-2018-10125.YAML
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2018-10125.yaml
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2018-10125.yaml
reference_id CVE-2018-10125.YAML
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2018-10125.yaml
7
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2018-10125.yaml
reference_id CVE-2018-10125.YAML
reference_type
scores
0
value 6.1
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2018-10125.yaml
8
reference_url https://github.com/advisories/GHSA-pj4j-287j-f742
reference_id GHSA-pj4j-287j-f742
reference_type
scores
url https://github.com/advisories/GHSA-pj4j-287j-f742
fixed_packages
0
url pkg:composer/contao/core-bundle@4.4.17
purl pkg:composer/contao/core-bundle@4.4.17
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fux-z15d-13g1
1
vulnerability VCID-4rrm-u81m-7kdt
2
vulnerability VCID-5kwa-7kx3-kfga
3
vulnerability VCID-98fv-kpqs-mybc
4
vulnerability VCID-ah8s-8q49-8qbw
5
vulnerability VCID-u6sk-25yd-e7b2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.4.17
1
url pkg:composer/contao/core-bundle@4.4.18
purl pkg:composer/contao/core-bundle@4.4.18
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fux-z15d-13g1
1
vulnerability VCID-4rrm-u81m-7kdt
2
vulnerability VCID-5kwa-7kx3-kfga
3
vulnerability VCID-98fv-kpqs-mybc
4
vulnerability VCID-ah8s-8q49-8qbw
5
vulnerability VCID-u6sk-25yd-e7b2
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.4.18
2
url pkg:composer/contao/core-bundle@4.5.7
purl pkg:composer/contao/core-bundle@4.5.7
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fux-z15d-13g1
1
vulnerability VCID-5kwa-7kx3-kfga
2
vulnerability VCID-98fv-kpqs-mybc
3
vulnerability VCID-ah8s-8q49-8qbw
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.5.7
3
url pkg:composer/contao/core-bundle@4.5.8
purl pkg:composer/contao/core-bundle@4.5.8
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3fux-z15d-13g1
1
vulnerability VCID-5kwa-7kx3-kfga
2
vulnerability VCID-98fv-kpqs-mybc
3
vulnerability VCID-ah8s-8q49-8qbw
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.5.8
aliases CVE-2018-10125, GHSA-pj4j-287j-f742
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-epmj-qf23-xffd
6
url VCID-u6sk-25yd-e7b2
vulnerability_id VCID-u6sk-25yd-e7b2
summary 
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2020-25768
reference_id
reference_type
scores
0
value 0.0031
scoring_system epss
scoring_elements 0.54463
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2020-25768
1
reference_url https://community.contao.org/en/forumdisplay.php?4-Announcements
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://community.contao.org/en/forumdisplay.php?4-Announcements
2
reference_url https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html
3
reference_url https://github.com/contao/contao
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2020-25768
reference_id CVE-2020-25768
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2020-25768
5
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2020-25768.yaml
reference_id CVE-2020-25768.YAML
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/contao/CVE-2020-25768.yaml
6
reference_url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2020-25768.yaml
reference_id CVE-2020-25768.YAML
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2020-25768.yaml
7
reference_url https://github.com/advisories/GHSA-f7wm-x4gw-6m23
reference_id GHSA-f7wm-x4gw-6m23
reference_type
scores
url https://github.com/advisories/GHSA-f7wm-x4gw-6m23
8
reference_url https://github.com/contao/contao/security/advisories/GHSA-f7wm-x4gw-6m23
reference_id GHSA-f7wm-x4gw-6m23
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/contao/contao/security/advisories/GHSA-f7wm-x4gw-6m23
fixed_packages
0
url pkg:composer/contao/core-bundle@4.4.52
purl pkg:composer/contao/core-bundle@4.4.52
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.4.52
1
url pkg:composer/contao/core-bundle@4.9.6
purl pkg:composer/contao/core-bundle@4.9.6
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.9.6
2
url pkg:composer/contao/core-bundle@4.10.1
purl pkg:composer/contao/core-bundle@4.10.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.10.1
aliases CVE-2020-25768, GHSA-f7wm-x4gw-6m23
risk_score 3.1
exploitability 0.5
weighted_severity 6.2
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-u6sk-25yd-e7b2
Fixing_vulnerabilities
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:composer/contao/core-bundle@4.4.16