Skip to content
Noroxi

contao records

43 published records for vendor contao.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
1
With a fix record
88.4%
Median publish → KEV
No record has entered KEV

Records by year

  1. 17
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

43 records
  • CVE-2022-26265
    48Plan

    Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 30%

    contao · contaoMar 18, 2022

  • CVE-2014-1860
    40Plan

    Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities

    CriticalCVSS 9.8No exploitEPSS 3%

    contao · contao cmsJan 8, 2020

  • CVE-2017-16558
    39Monitor

    Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module.

    CriticalCVSS 9.8No exploitEPSS 1%

    contao · contao cmsApr 25, 2019

  • CVE-2019-11512
    39Monitor

    Contao 4.x allows SQL Injection.

    CriticalCVSS 9.8No exploitEPSS 1%

    contao · contaoJul 9, 2019

  • CVE-2019-10641
    39Monitor

    Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.

    CriticalCVSS 9.8No exploitEPSS 1%

    contao · contao cmsApr 17, 2019

  • CVE-2019-10643
    39Monitor

    Contao 4.7 allows Use of a Key Past its Expiration Date.

    CriticalCVSS 9.8No exploitEPSS 1%

    contao · contao cmsApr 17, 2019

  • CVE-2017-10993
    36Monitor

    Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter i

    HighCVSS 8.8No exploitEPSS 2%

    contao · contao cmsJul 21, 2017

  • CVE-2019-19745
    35Monitor

    Contao 4.0 through 4.8.5 allows PHP local file inclusion.

    HighCVSS 8.8No exploitEPSS 1%

    contao · contaoDec 17, 2019

  • CVE-2012-4383
    35Monitor

    contao prior to 2.11.4 has a sql injection vulnerability

    HighCVSS 8.8No exploitEPSS 0%

    contao · contaoJan 29, 2020

  • CVE-2024-45398
    35Monitor

    Remote command execution through file upload in contao/core-bundle

    HighCVSS 8.8No exploitEPSS 0%

    contao · contaoSep 17, 2024

  • CVE-2019-10642
    35Monitor

    Contao 4.7 allows CSRF.

    HighCVSS 8.8No exploitEPSS 0%

    contao · contao cmsApr 17, 2019

  • CVE-2021-37626
    28Monitor

    PHP file inclusion via insert tags

    HighCVSS 7.2No exploitEPSS 1%

    contao · contaoAug 11, 2021

  • CVE-2021-37627
    28Monitor

    Privilege escalation via form generator

    HighCVSS 7.2No exploitEPSS 1%

    contao · contaoAug 11, 2021

  • CVE-2024-30262
    28Monitor

    Contao's remember-me tokens will not be cleared after a password change

    HighCVSS 7.1No exploitEPSS 0%

    contao · contaoApr 9, 2024

  • CVE-2012-1297
    27Monitor

    Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attack

    MediumCVSS 6.8Proof of conceptEPSS 1%

    contao · contao cmsMar 19, 2012

  • CVE-2018-20028
    26Monitor

    Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control.

    MediumCVSS 6.5No exploitEPSS 0%

    contao · contao cmsApr 17, 2019

  • CVE-2023-29200
    26Monitor

    contao/core-bundle has path traversal vulnerability in the file manager

    MediumCVSS 6.5No exploitEPSS 0%

    contao · contaoApr 25, 2023

  • CVE-2024-28235
    26Monitor

    Contao possible cookie sharing with external domains while checking protected pages for broken links

    MediumCVSS 6.5No exploitEPSS 0%

    contao · contaoApr 9, 2024

  • CVE-2025-65960
    26Monitor

    Contao is vulnerable to remote code execution in template closures

    MediumCVSS 6.6No exploitEPSS 0%

    contao · contaoNov 25, 2025

  • CVE-2022-24899
    25Monitor

    Cross site scripting via canonical tag

    MediumCVSS 6.1Proof of conceptEPSS 4%

    contao · contaoMay 5, 2022

  • CVE-2018-10125
    24Monitor

    Contao before 4.5.7 has XSS in the system log.

    MediumCVSS 6.1No exploitEPSS 0%

    contao · contaoMar 16, 2020

  • CVE-2021-35210
    24Monitor

    Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS.

    MediumCVSS 6.1No exploitEPSS 0%

    contao · contaoJun 23, 2021

  • CVE-2018-5478
    24Monitor

    Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.

    MediumCVSS 6.1No exploitEPSS 0%

    contao · contaoSep 21, 2023

  • CVE-2019-19712
    21Monitor

    Contao 4.0 through 4.8.5 has Insecure Permissions.

    MediumCVSS 5.3No exploitEPSS 0%

    contao · contaoDec 17, 2019

  • CVE-2019-19714
    21Monitor

    Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output.

    MediumCVSS 5.3No exploitEPSS 0%

    contao · contaoDec 17, 2019