Description
Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | contao/core | >= 3.0.0, < 3.5.32 | 3.5.32 | GHSA-mpg7-2rx9-h5qp |
Medium · 6.1
CVE-2018-5478
EUVD-2023-2550GHSA-mpg7-2rx9-h5qp
Contao Cross-site Scripting vulnerabililty
Published Sep 21, 2023 · Updated Sep 24, 2024 · Assigned by mitre