Skip to content
OpenAdvisories

Package · Packagist

contao/core

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.0
    GHSA-wxxw-5gq6-j2g5

    contao/core Insufficient input validation allows for code injection and remote execution

    contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation. In fact, attackers can remove or change pathconfig.php by entering a URL, meaning that the entire C…

    contao/core Packagist
  • Critical 9.8
    CVE-2019-10641

    Contao Does Not Invalidate Existing Sessions When Password Changes

    Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.

    contao/core-bundle contao/contao contao/core Packagist