CO
Vendor
contao
53
CVEs
0
On KEV
7
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-107851 | CO contao contao | 4.3 | Oct 9 | Contao: Improper access control in the table access voter |
| CVE-2026-107850 | CO contao contao | 4.3 | Oct 9 | Contao: Improper access control in the preview links module |
| CVE-2026-107848 | CO contao contao | 3.5 | Oct 9 | Contao: Cross-site request forgery in custom backend actions |
| CVE-2026-107845 | CO contao contao | 9.3 | Oct 9 | Contao: Cross-site scripting in the comments bundle |
| CVE-2026-107844 | CO contao contao | 5.3 | Oct 9 | Contao: Path traversal in the images controller |
| CVE-2026-107843 | CO contao contao | 5.3 | Oct 9 | Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check |
| CVE-2026-107842 | CO contao contao | 5.3 | Oct 9 | Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled |
| CVE-2026-55825 | CO contao contao | 3.1 | Jul 31 | Contao: Possible path traversal in job download URIs |
| CVE-2026-55824 | CO contao contao | 2.6 | Jul 31 | Contao crawler leaks auth credentials to external hosts |
| CVE-2026-57232 | CO contao contao | 3.1 | Jul 31 | Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module |
| CVE-2025-65961 | CO contao contao | 4.8 | Nov 25 | Contao is vulnerable to cross-site scripting in templates |
| CVE-2025-65960 | CO contao contao | 6.6 | Nov 25 | Contao is vulnerable to remote code execution in template closures |
| CVE-2025-57759 | CO contao contao | 4.3 | Aug 28 | Contao has improper privilege management for page and article fields |
| CVE-2025-57758 | CO contao contao | 4.3 | Aug 28 | Contao has improper access control in the back end voters |
| CVE-2025-57757 | CO contao contao | 5.3 | Aug 28 | Contao discloses information in the news module |
| CVE-2025-57756 | CO contao contao | 5.3 | Aug 28 | Contao discloses sensitive information in the front end search index |
| CVE-2025-29790 | CO contao contao | 5.4 | Mar 18 | Contao allows cross-site scripting through SVG uploads |
| CVE-2024-45965 | CO Contao Contao | 5.4 | Oct 2 | Contao before 5.5.6 allows XSS via an SVG document |
| CVE-2024-45604 | CO Contao Contao | 4.3 | Sep 17 | Contao is an Open Source CMS |
| CVE-2024-45398 | CO Contao Contao | 8.8 | Sep 17 | Contao is an Open Source CMS |
| CVE-2024-45612 | CO Contao Contao | 5.3 | Sep 17 | Contao is an Open Source CMS |
| CVE-2024-30262 | CO Contao Contao | 7.1 | Apr 9 | Contao is an open source content management system |
| CVE-2024-28235 | CO Contao Contao | 6.5 | Apr 9 | Contao is an open source content management system |
| CVE-2024-28234 | CO Contao Contao | 4.7 | Apr 9 | Contao is an open source content management system |
| CVE-2024-28191 | CO Contao Contao | 5.4 | Apr 9 | Contao is an open source content management system |
| CVE-2024-28190 | CO Contao Contao | 5.4 | Apr 9 | Contao is an open source content management system |
| CVE-2018-5478 | CO Contao Contao | 6.1 | Sep 21 | Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension |
| CVE-2023-36806 | CO Contao Contao | 5.4 | Jul 25 | Contao is an open source content management system |
| CVE-2023-29200 | CO Contao Contao | 6.5 | Apr 25 | Contao is an open source content management system |
| CVE-2022-24899 | CO Contao Contao | 6.1 | May 6 | Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications |
| CVE-2022-26265 | CO Contao Contao | 9.8 | Mar 18 | Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter |
| CVE-2021-35955 | CO Contao Contao | 4.8 | Aug 12 | Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field |
| CVE-2021-37627 | CO Contao Contao | 7.2 | Aug 11 | Contao is an open source CMS that allows creation of websites and scalable web applications |
| CVE-2021-37626 | CO Contao Contao | 7.2 | Aug 11 | Contao is an open source CMS that allows you to create websites and scalable web applications |
| CVE-2021-35210 | CO Contao Contao | 6.1 | Jun 23 | Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS |
| CVE-2020-25768 | CO Contao Contao | 5.3 | Oct 7 | Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation |
| CVE-2018-10125 | CO Contao Contao | 6.1 | Mar 16 | Contao before 4.5.7 has XSS in the system log |
| CVE-2012-4383 | CO Contao Contao | 8.8 | Jan 29 | contao prior to 2.11.4 has a sql injection vulnerability |
| CVE-2014-1860 | CC Contao Cms Contao | 9.8 | Jan 8 | Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities |
| CVE-2019-19745 | CO Contao Contao | 8.8 | Dec 17 | Contao 4.0 through 4.8.5 allows PHP local file inclusion |
| CVE-2019-19714 | CO Contao Contao | 5.3 | Dec 17 | Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output |
| CVE-2019-19712 | CO Contao Contao | 5.3 | Dec 17 | Contao 4.0 through 4.8.5 has Insecure Permissions |
| CVE-2019-11512 | CO Contao Contao | 9.8 | Jul 9 | Contao 4.x allows SQL Injection |
| CVE-2017-16558 | CC Contao Cms Contao | 9.8 | Apr 25 | Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module |
| CVE-2019-10643 | CC Contao Cms Contao | 9.8 | Apr 17 | Contao 4.7 allows Use of a Key Past its Expiration Date |
| CVE-2019-10642 | CC Contao Cms Contao | 8.8 | Apr 17 | Contao 4.7 allows CSRF |
| CVE-2019-10641 | CC Contao Cms Contao | 9.8 | Apr 17 | Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password |
| CVE-2018-20028 | CC Contao Cms Contao | 6.5 | Apr 17 | Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control |
| CVE-2017-10993 | CC Contao Cms Contao | 8.8 | Jul 21 | Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal |
| CVE-2015-0269 | CC Contao Cms Contao | 4.3 | May 26 | Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the… |
| CVE-2012-1297 | CC Contao Cms Contao | – | Mar 19 | Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of… |
| CVE-2011-4335 | CC Contao Cms Contao | – | Nov 28 | Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php in a (1)… |
| CVE-2011-0508 | CC Contao Cms Contao | – | Jan 20 | Cross-site scripting (XSS) vulnerability in system/modules/comments/Comments.php in Contao CMS 2.9.2, and possibly other versions before 2.9.3, allows remote attackers to inject… |