CVSS: 4.7EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45965
https://notcve.org/view.php?id=CVE-2024-45965
02 Oct 2024 — Contao 5.4.1 allows an authenticated admin account to upload a SVG file containing malicious javascript code into the target system. If the file is accessed through the website, it could lead to a Cross-Site Scripting (XSS) attack or execute arbitrary code via a crafted javascript to the target. • https://grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-45604 – Directory traversal in the file selector widget in contao/core-bundle
https://notcve.org/view.php?id=CVE-2024-45604
17 Sep 2024 — Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Users are advised to update to Contao 4.13.49. There are no known workarounds for this vulnerability. • https://contao.org/en/security-advisories/directory-traversal-in-the-fileselector-widget • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 9.0EPSS: 0%CPEs: 3EXPL: 0CVE-2024-45398 – Remote command execution through file upload in contao/core-bundle
https://notcve.org/view.php?id=CVE-2024-45398
17 Sep 2024 — Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does not execute PHP files and other scripts in the Contao file upload directory. • https://contao.org/en/security-advisories/remote-command-execution-through-file-uploads • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2024-45612 – Insert tag injection via canonical URL in Contao
https://notcve.org/view.php?id=CVE-2024-45612
17 Sep 2024 — Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (front end). Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to upgrade should disable canonical tags in the root page settings. • https://contao.org/en/security-advisories/insert-tag-injection-via-canonical-urls • CWE-20: Improper Input Validation •
CVSS: 5.9EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30262 – Contao's remember-me tokens will not be cleared after a password change
https://notcve.org/view.php?id=CVE-2024-30262
09 Apr 2024 — Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module. • https://github.com/contao/contao/commit/3032baa456f607169ffae82a8920354adb338fe9 • CWE-384: Session Fixation CWE-613: Insufficient Session Expiration •
CVSS: 8.3EPSS: 0%CPEs: 2EXPL: 0CVE-2024-28235 – Contao possible cookie sharing with external domains while checking protected pages for broken links
https://notcve.org/view.php?id=CVE-2024-28235
09 Apr 2024 — Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages. Contao es un sistema de gestión de contenidos de código abierto. • https://contao.org/en/security-advisories/session-cookie-disclosure-in-the-crawler • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 2EXPL: 0CVE-2024-28234 – Contao has insufficient BBCode sanitizer
https://notcve.org/view.php?id=CVE-2024-28234
09 Apr 2024 — Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments. • https://contao.org/en/security-advisories/insufficient-bbcode-sanitization • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-28191 – Contao may have unencoded insert tags in the frontend
https://notcve.org/view.php?id=CVE-2024-28191
09 Apr 2024 — Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character. Contao es un sistema de gestión de contenidos de código abierto. • https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-28190 – Contao core bundle vulnerable to cross site scripting in the file manager
https://notcve.org/view.php?id=CVE-2024-28190
09 Apr 2024 — Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users. Contao es un sistema de gestión de contenidos de código abierto. • https://contao.org/en/security-advisories/cross-site-scripting-in-the-file-manager • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2018-5478
https://notcve.org/view.php?id=CVE-2018-5478
21 Sep 2023 — Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension. Contao 3.x anterior a 3.5.32 permite XSS a través del módulo de cancelación de suscripción en la extensión del boletín frontal. • https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core/CVE-2018-5478.yaml • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •