Security
فارسی
All products

contao/contao

Composer · Package
48 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader ModuleCVE-2026-57232 · GHSA-87MG-5GRR-RHWHVersion ranges need review. contao/contaocontao/core-bundle Composer Low Fix reported
Cross site scripting in the system logCVE-2021-35210 · GHSA-H58V-C6RF-G9F7Version ranges need review. contao/contaocontao/core-bundle Composer Medium Fix reported
Contao: Possible path traversal in job download URIsCVE-2026-55825 · GHSA-GRM4-WM43-9JH5 contao/contaocontao/core-bundle Composer Low Fix reported
Contao crawler leaks auth credentials to external hostsCVE-2026-55824 · GHSA-3MR9-P497-58F6Version ranges need review. contao/contaocontao/core-bundle Composer Low Fix reported
Privilege escalation via form generatorCVE-2021-37627 · GHSA-HQ5M-MQMX-FW6MVersion ranges need review. contao/contaocontao/core-bundle Composer High Fix reported
Cross site scripting via HTML attributes in the back endCVE-2021-35955 · GHSA-HR3H-X6GQ-RQCPVersion ranges need review. contao/contaocontao/core-bundle Composer Medium Fix reported
PHP file inclusion via insert tagsCVE-2021-37626 · GHSA-R6MV-PPJC-4HGRVersion ranges need review. contao/contaocontao/core-bundle Composer Medium Fix reported
Contao applies improper access control in the back end votersCVE-2025-57758 · GHSA-7M47-R75R-CX8V contao/contaocontao/core-bundle Composer Medium Fix reported
Contao does not properly manage privileges for page and article fieldsCVE-2025-57759 · GHSA-QQFQ-7CPP-HCQJ contao/contaocontao/core-bundle Composer Medium Fix reported
Contao can disclose sensitive information in the news moduleCVE-2025-57757 · GHSA-W53M-GXVG-VX7P contao/contaocontao/core-bundle Composer Medium Fix reported
Contao discloses sensitive information in the front end search indexCVE-2025-57756 · GHSA-2XMJ-8WMQ-7475 contao/contaocontao/core-bundle Composer Medium Fix reported
Cross site scripting via canonical tag in ContaoCVE-2022-24899 · GHSA-M8X6-6R63-QVJ2 contao/contaocontao/core-bundle Composer High Fix reported
Unrestricted file uploads in ContaoCVE-2019-19745 · GHSA-WJX8-CGRM-HH8PVersion ranges need review. contao/contaocontao/core-bundle Composer High Fix reported
Contao Core directory traversal vulnerabilityCVE-2017-10993 · GHSA-X5G4-CRXQ-QXJX contao/contaocontao/core-bundle Composer High Fix reported
Contao Does Not Invalidate Existing Sessions When Password ChangesCVE-2019-10641 · GHSA-VCGG-HP4R-87GXVersion ranges need review. contao/contaocontao/core-bundle Composer Critical Fix reported
Contao Does Not Expire Tokens CorrectlyCVE-2019-10643 · GHSA-J99G-QJVX-995G contao/contaocontao/core-bundle Composer Critical Fix reported
Contao SQL injection in the file managerCVE-2019-11512 · GHSA-VQ59-X6MQ-4WGWVersion ranges need review. contao/contaocontao/core-bundle Composer Critical Fix reported
Contao CSRF Token BypassCVE-2019-10642 · GHSA-HWMH-9JJ9-8C9C contao/contaocontao/core-bundle Composer High Fix reported
Contao Information Disclosure via Access Control FlawsCVE-2018-20028 · GHSA-Q99W-J4MJ-7HJ8 contao/contao Composer Medium Fix reported
Contao SQL injection in the backend and listing moduleCVE-2017-16558 · GHSA-W38G-HJ45-MJJPVersion ranges need review. contao/contaocontao/core-bundle Composer Critical Fix reported