Security
فارسی
All products

contao/core-bundle

Composer · Package
62 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabledCVE-2026-107842 · GHSA-X2RP-9QF7-2FMQVersion ranges need review. contao/core-bundle Composer Medium Fix reported
Contao: Improper access control in the preview links moduleCVE-2026-107850 · GHSA-Q6WP-FR43-GM9V contao/core-bundle Composer Medium Fix reported
Contao: The registration module re-sends activation mailsCVE-2026-107843 · GHSA-MFXH-VP55-7GC6Version ranges need review. contao/core-bundle Composer Medium Fix reported
Contao: Path traversal in the images controllerCVE-2026-107844 · GHSA-MRVP-7WMX-5M4HVersion ranges need review. contao/core-bundle Composer Medium Fix reported
Contao: Cross-site request forgery in custom backend actionsCVE-2026-107848 · GHSA-9FF2-P842-45WQVersion ranges need review. contao/core-bundle Composer Low Fix reported
Contao: Improper access control in the table access voterCVE-2026-107851 · GHSA-5974-GFQC-WRCM contao/core-bundle Composer Medium Fix reported
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader ModuleCVE-2026-57232 · GHSA-87MG-5GRR-RHWHVersion ranges need review. contao/contaocontao/core-bundle Composer Low Fix reported
Contao: Unencoded insert tags in the frontendCVE-2024-28191 · GHSA-747V-52C4-8VJ8 contao/core-bundle Composer Low Fix reported
Contao: Remember-me tokens will not be cleared after a password changeCVE-2024-30262 · GHSA-R4R6-J2J3-7PP5 contao/core-bundle Composer Medium Fix reported
Contao: Possible cookie sharing with external domains while checking protected pages for broken linksCVE-2024-28235 · GHSA-9JH5-QF84-X6PR contao/core-bundle Composer High Fix reported
Contao: Cross site scripting in the file managerCVE-2024-28190 · GHSA-V24P-7P4J-QVVF contao/core-bundle Composer Medium Fix reported
Cross site scripting via input unit widgetCVE-2023-36806 · GHSA-4GPR-P634-922X contao/core-bundle Composer Medium Fix reported
Cross site scripting in the system logCVE-2021-35210 · GHSA-H58V-C6RF-G9F7Version ranges need review. contao/contaocontao/core-bundle Composer Medium Fix reported
Contao: Possible path traversal in job download URIsCVE-2026-55825 · GHSA-GRM4-WM43-9JH5 contao/contaocontao/core-bundle Composer Low Fix reported
Contao crawler leaks auth credentials to external hostsCVE-2026-55824 · GHSA-3MR9-P497-58F6Version ranges need review. contao/contaocontao/core-bundle Composer Low Fix reported
Privilege escalation via form generatorCVE-2021-37627 · GHSA-HQ5M-MQMX-FW6MVersion ranges need review. contao/contaocontao/core-bundle Composer High Fix reported
Cross site scripting via HTML attributes in the back endCVE-2021-35955 · GHSA-HR3H-X6GQ-RQCPVersion ranges need review. contao/contaocontao/core-bundle Composer Medium Fix reported
PHP file inclusion via insert tagsCVE-2021-37626 · GHSA-R6MV-PPJC-4HGRVersion ranges need review. contao/contaocontao/core-bundle Composer Medium Fix reported
Contao is vulnerable to cross-site scripting in templatesCVE-2025-65961 · GHSA-68Q5-78XP-CWWC contao/core-bundle Composer Low Fix reported
Contao is vulnerable to remote code execution in template closuresCVE-2025-65960 · GHSA-98VJ-MM79-V77R contao/core-bundle Composer Medium Fix reported