9 results · Feed
-
High —
contao/core PHP object injection vulnerability allows for arbitrary code execution
PHP object injection vulnerability was identified in contao/core due to untrusted data being passed to `deserialize()` function.
-
Critical 9.0
contao/core Insufficient input validation allows for code injection and remote execution
contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation. In fact, attackers can remove or change pathconfig.php by entering a URL, meaning that the entire C…
-
Medium 6.1
Contao Cross-site Scripting vulnerabililty
Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.
-
Medium 6.1
Cross-site Scripting in Contao
Contao before 4.5.7 has XSS in the system log.
-
High 8.8
Contao core SQL Injection Vulnerability
contao prior to 2.11.4 has a sql injection vulnerability
-
Critical 9.8
Contao Does Not Invalidate Existing Sessions When Password Changes
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
-
High 8.8
Contao Core directory traversal vulnerability
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.
-
Medium 4.3
Contao Core directory traversal vulnerability
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors.
-
Medium 6.1
MediaElement Vulnerable to Reflected XSS
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, …