CVE Daily – Contao (High+Critical)

CVE Daily – Contao (High+Critical) https://cvedaily.com/pages/tags/contao.html CVE Daily – Contao (High+Critical) en Wed, 03 Jun 2026 21:27:03 +0000 [High] CVE-2024-45398 – Contao is an Open Source CMS. In affected versions a back end user with access t... https://nvd.nist.gov/vuln/detail/CVE-2024-45398 https://nvd.nist.gov/vuln/detail/CVE-2024-45398 Tue, 17 Sep 2024 20:15:04 +0000 High CVE-2024-45398

Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does not execute PHP files and other scripts in the Contao file upload directory.

CVSS: 8.3 · CWE: CWE-434

]]> [High] CVE-2024-28235 – Contao is an open source content management system. Starting in version 4.9.0 an... https://nvd.nist.gov/vuln/detail/CVE-2024-28235 https://nvd.nist.gov/vuln/detail/CVE-2024-28235 Tue, 09 Apr 2024 16:15:07 +0000 High CVE-2024-28235

Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protecte…

CVSS: 8.3 · CWE: CWE-200

]]> [High] CVE-2022-24899 – Contao is a powerful open source CMS that allows you to create professional webs... https://nvd.nist.gov/vuln/detail/CVE-2022-24899 https://nvd.nist.gov/vuln/detail/CVE-2022-24899 Fri, 06 May 2022 00:15:07 +0000 High CVE-2022-24899

Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is possible to inject code into the canonical tag. As a workaround users may disable canonical tags in the root page settings.

CVSS: 7.2 · CWE: CWE-79

]]> [Critical] CVE-2022-26265 – Contao Managed Edition v1.5.0 was discovered to contain a remote command executi... https://nvd.nist.gov/vuln/detail/CVE-2022-26265 https://nvd.nist.gov/vuln/detail/CVE-2022-26265 Fri, 18 Mar 2022 23:15:07 +0000 Critical CVE-2022-26265

Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.

CVSS: 9.8 · CWE: CWE-78

]]> [High] CVE-2021-37627 – Contao is an open source CMS that allows creation of websites and scalable web a... https://nvd.nist.gov/vuln/detail/CVE-2021-37627 https://nvd.nist.gov/vuln/detail/CVE-2021-37627 Wed, 11 Aug 2021 23:15:07 +0000 High CVE-2021-37627

Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in the Contao back end. Installations are only affected if they have untrusted back end users who have access to the form generator. All users are advised to update to Contao 4.4.56, 4.9.18 or 4.11.7. As a workaround users may disable the form…

CVSS: 8.0 · CWE: CWE-269

]]> [High] CVE-2021-37626 – Contao is an open source CMS that allows you to create websites and scalable web... https://nvd.nist.gov/vuln/detail/CVE-2021-37626 https://nvd.nist.gov/vuln/detail/CVE-2021-37626 Wed, 11 Aug 2021 23:15:07 +0000 High CVE-2021-37626

Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify fields that are shown in the front end. Update to Contao 4.4.56, 4.9.18 or 4.11.7 to resolve. If you c…

CVSS: 7.2 · CWE: CWE-94

]]> [High] CVE-2012-4383 – contao prior to 2.11.4 has a sql injection vulnerability https://nvd.nist.gov/vuln/detail/CVE-2012-4383 https://nvd.nist.gov/vuln/detail/CVE-2012-4383 Wed, 29 Jan 2020 15:15:10 +0000 High CVE-2012-4383

contao prior to 2.11.4 has a sql injection vulnerability

CVSS: 8.8 · CWE: CWE-89

]]> [Critical] CVE-2014-1860 – Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities https://nvd.nist.gov/vuln/detail/CVE-2014-1860 https://nvd.nist.gov/vuln/detail/CVE-2014-1860 Wed, 08 Jan 2020 16:15:10 +0000 Critical CVE-2014-1860

Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities

CVSS: 9.8 · CWE: CWE-502

]]> [High] CVE-2019-19745 – Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with a... https://nvd.nist.gov/vuln/detail/CVE-2019-19745 https://nvd.nist.gov/vuln/detail/CVE-2019-19745 Tue, 17 Dec 2019 15:15:25 +0000 High CVE-2019-19745

Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the server.

CVSS: 8.8 · CWE: CWE-434

]]> [Critical] CVE-2019-11512 – Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5. https://nvd.nist.gov/vuln/detail/CVE-2019-11512 https://nvd.nist.gov/vuln/detail/CVE-2019-11512 Tue, 09 Jul 2019 21:15:10 +0000 Critical CVE-2019-11512

Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.

CVSS: 9.8 · CWE: CWE-89

]]> [Critical] CVE-2017-16558 – Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerabilit... https://nvd.nist.gov/vuln/detail/CVE-2017-16558 https://nvd.nist.gov/vuln/detail/CVE-2017-16558 Thu, 25 Apr 2019 17:29:00 +0000 Critical CVE-2017-16558

Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.

CVSS: 9.8 · CWE: CWE-89

]]> [Critical] CVE-2019-10643 – Contao 4.7 allows Use of a Key Past its Expiration Date. https://nvd.nist.gov/vuln/detail/CVE-2019-10643 https://nvd.nist.gov/vuln/detail/CVE-2019-10643 Wed, 17 Apr 2019 19:29:00 +0000 Critical CVE-2019-10643

Contao 4.7 allows Use of a Key Past its Expiration Date.

CVSS: 9.8 · CWE: CWE-287

]]> [High] CVE-2019-10642 – Contao 4.7 allows CSRF. https://nvd.nist.gov/vuln/detail/CVE-2019-10642 https://nvd.nist.gov/vuln/detail/CVE-2019-10642 Wed, 17 Apr 2019 19:29:00 +0000 High CVE-2019-10642

Contao 4.7 allows CSRF.

CVSS: 8.8 · CWE: CWE-352

]]> [Critical] CVE-2019-10641 – Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism... https://nvd.nist.gov/vuln/detail/CVE-2019-10641 https://nvd.nist.gov/vuln/detail/CVE-2019-10641 Wed, 17 Apr 2019 19:29:00 +0000 Critical CVE-2019-10641

Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.

CVSS: 9.8 · CWE: CWE-640

]]> [High] CVE-2017-10993 – Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and... https://nvd.nist.gov/vuln/detail/CVE-2017-10993 https://nvd.nist.gov/vuln/detail/CVE-2017-10993 Fri, 21 Jul 2017 06:29:00 +0000 High CVE-2017-10993

Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.

CVSS: 8.8 · CWE: CWE-22

]]>