CO
Product
contao
42
CVEs
0
On KEV
9.8
Max CVSS
7
New 30D
Severity mix
Critical 3High 6Medium 29Low 4
Watch
Add contao to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-65960 | 6.6 | Nov 25 | Contao is vulnerable to remote code execution in template closures Affected: >= 4.0.0, < 4.13.57; >= 5.0.0-RC1, < 5.3.42; >= 5.4.0-RC1, < 5.6.5 |
| CVE-2024-28235 | 6.5 | Apr 9 | Contao is an open source content management system Affected: 4.9.0 before 4.13.40; 5.0.0 before 5.3.4 |
| CVE-2023-29200 | 6.5 | Apr 25 | Contao is an open source content management system Affected: 2.0 before 4.9.40; 4.10.0 before 4.13.21; 5.0.0 before 5.1.4 |
| CVE-2018-5478 | 6.1 | Sep 21 | Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension Affected: 3.0.0 before 3.5.32 |
| CVE-2022-24899 | 6.1 | May 6 | Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications Affected: 4.13.0 through 4.13.2 |
| CVE-2021-35210 | 6.1 | Jun 23 | Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS Affected: 4.5.0 before 4.9.16; 4.10.0 before 4.11.5 |
| CVE-2018-10125 | 6.1 | Mar 16 | Contao before 4.5.7 has XSS in the system log Affected: 3.0.0 through 3.5.33; 4.4.0 through 4.4.16; 4.5.0 through 4.5.6; 4.0.0; 4.1.0; 4.2.0; +1 more |
| CVE-2025-29790 | 5.4 | Mar 18 | Contao allows cross-site scripting through SVG uploads Affected: >= 4.0.0, < 4.13.54; >= 5.0.0, < 5.3.30; >= 5.4.0, < 5.5.6 |
| CVE-2024-45965 | 5.4 | Oct 2 | Contao before 5.5.6 allows XSS via an SVG document Affected: 4.0 before 4.13.54; 5.0.0 before 5.3.30; 5.4.0 before 5.5.6 |
| CVE-2024-28191 | 5.4 | Apr 9 | Contao is an open source content management system Affected: 4.0.0 before 4.13.40; 5.0.0 before 5.3.4 |
| CVE-2024-28190 | 5.4 | Apr 9 | Contao is an open source content management system Affected: 4.0.0 before 4.13.40; 5.0.0 before 5.3.4 |
| CVE-2023-36806 | 5.4 | Jul 25 | Contao is an open source content management system Affected: 4.0.0 before 4.9.42; 4.10.0 before 4.13.28; 5.0.0 before 5.1.10 |
| CVE-2026-107844 | 5.3 | Oct 9 | Contao: Path traversal in the images controller Affected: >= 5.0.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 |
| CVE-2026-107843 | 5.3 | Oct 9 | Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check Affected: >= 4.1.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 |
| CVE-2026-107842 | 5.3 | Oct 9 | Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled Affected: >= 4.0.0, < 5.3.50; >= 5.4.0-RC1, < 5.7.12 |
| CVE-2025-57757 | 5.3 | Aug 28 | Contao discloses information in the news module Affected: >= 5.0.0-RC1, < 5.3.38; >= 5.4.0-RC1, < 5.6.1 |
| CVE-2025-57756 | 5.3 | Aug 28 | Contao discloses sensitive information in the front end search index Affected: >= 4.9.14, < 4.13.56; >= 5.0.0-RC1, < 5.3.38; >= 5.4.0-RC1, < 5.6.1 |
| CVE-2024-45612 | 5.3 | Sep 17 | Contao is an Open Source CMS Affected: 4.13.0 before 4.13.49; 5.3.0 before 5.3.15; 5.4.0 before 5.4.3 |
| CVE-2020-25768 | 5.3 | Oct 7 | Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation Affected: 4.0 before 4.4.52; 4.9.0 before 4.9.6; 4.10.0 before 4.10.1 |
| CVE-2019-19714 | 5.3 | Dec 17 | Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output Affected: 4.8.4; 4.8.5 |
| CVE-2019-19712 | 5.3 | Dec 17 | Contao 4.0 through 4.8.5 has Insecure Permissions Affected: 4.4.0 through 4.4.45; 4.8 through 4.8.5; 4.0; 4.1; 4.2; 4.3; +3 more |
| CVE-2025-65961 | 4.8 | Nov 25 | Contao is vulnerable to cross-site scripting in templates Affected: >= 4.0.0, < 4.13.57; >= 5.0.0-RC1, < 5.3.42; >= 5.4.0-RC1, < 5.6.5 |
| CVE-2021-35955 | 4.8 | Aug 12 | Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field Affected: 4.0.0 before 4.4.56; 4.5.0 before 4.9.18; 4.10.0 before 4.11.7 |
| CVE-2024-28234 | 4.7 | Apr 9 | Contao is an open source content management system Affected: 2.0 before 4.13.40; 5.0.0 before 5.3.4 |
| CVE-2026-107851 | 4.3 | Oct 9 | Contao: Improper access control in the table access voter Affected: >= 5.7.0, < 5.7.12 |
| CVE-2026-107850 | 4.3 | Oct 9 | Contao: Improper access control in the preview links module Affected: >= 5.7.1, < 5.7.12 |
| CVE-2025-57759 | 4.3 | Aug 28 | Contao has improper privilege management for page and article fields Affected: >= 5.3.0, < 5.3.38; >= 5.4.0-RC1, < 5.6.1 |
| CVE-2025-57758 | 4.3 | Aug 28 | Contao has improper access control in the back end voters Affected: >= 5.0.0, < 5.3.38; >= 5.4.0-RC1, < 5.6.1 |
| CVE-2024-45604 | 4.3 | Sep 17 | Contao is an Open Source CMS Affected: before 4.13.49 |
Showing 29