Login Request a demo
CC
Product
Contao Cms
by Contao · last CVE Jan 8, 2020
11
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 4High 2Medium 2Low 0
Severity
All severities11Critical4High2Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Contao Cms to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2014-1860
9.8
4%
Jan 8
Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities
Affected: through 3.2.4
CVE-2017-16558
9.8
2%
Apr 25
Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module
Affected: 3.0.0 through 3.5.30; 4.0.0 through 4.4.7
CVE-2019-10643
9.8
1%
Apr 17
Contao 4.7 allows Use of a Key Past its Expiration Date
Affected: 4.7.0
CVE-2019-10641
9.8
1%
Apr 17
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password
Affected: before 3.5.39; 4.0.0 before 4.7.3
CVE-2019-10642
8.8
0%
Apr 17
Contao 4.7 allows CSRF
Affected: 4.7.0
CVE-2017-10993
8.8
3%
Jul 21
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal
Affected: through 3.5.27; 4.0.0; 4.0.0; 4.0.0; 4.0.1; 4.0.2; +32 more
CVE-2018-20028
6.5
1%
Apr 17
Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control
Affected: 3.0.0 before 3.5.37; 4.4.0 before 4.4.31; 4.6.0 before 4.6.11
CVE-2015-0269
4.3
2%
May 26
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the…
Affected: through 3.2.18; 3.4.0; 3.4.0; 3.4.1; 3.4.2; 3.4.3
CVE-2012-1297
–
1%
Mar 19
Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of…
Affected: through 2.11.0; 2.0; 2.0; 2.0; 2.1.0; 2.1.1; +34 more
CVE-2011-4335
–
2%
Nov 28
Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php in a (1)…
Affected: through 2.10.1; 2.0; 2.0; 2.0; 2.0; 2.1.0; +34 more
CVE-2011-0508
–
2%
Jan 20
Cross-site scripting (XSS) vulnerability in system/modules/comments/Comments.php in Contao CMS 2.9.2, and possibly other versions before 2.9.3, allows remote attackers to inject…
Affected: 2.9.2
Showing 11