GCVE - cpe:2.3:a:contao:contao_cms:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:contao:contao_cms:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Contao (`2e1f0faf-98d6-5a32-b645-9644099d89c5`)
Product	Contao Cms (`6a1e626c-e9f6-5c13-a2a8-6070d59276ce`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/contao/core`	purl2cpe	2026-06-01 10:16:56.066962

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-10641`	vulnerable	2026-06-08 05:12:24.843759	Details available Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password. Published: 2019-04-17T18:46:39.000Z Updated: 2024-08-04T22:32:00.987Z Open on db.gcve.eu Reference links https://contao.org/en/news.html https://contao.org/en/news/security-vulnerability-cve-2019-10641.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-20028`	vulnerable	2026-06-08 05:11:26.577680	Details available Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control. Published: 2019-04-17T18:58:45.000Z Updated: 2024-08-05T11:51:18.339Z Open on db.gcve.eu Reference links https://contao.org/en/news.html https://contao.org/en/news/security-vulnerability-cve-2018-20028.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-16558`	vulnerable	2026-06-08 05:09:00.606672	Details available Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module. Published: 2019-04-25T16:36:49.000Z Updated: 2024-08-05T20:27:03.999Z Open on db.gcve.eu Reference links https://contao.org/de/changelog/versions/4.4.html https://contao.org/en/news/contao-4_4_8.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2017-10993`	vulnerable	2026-06-08 05:08:36.691551	Details available Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal. Published: 2017-07-21T06:00:00.000Z Updated: 2024-08-05T17:57:57.413Z Open on db.gcve.eu Reference links https://contao.org/en/news/contao-3_5_28.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-0269`	vulnerable	2026-06-08 05:06:14.176780	Details available Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors. Published: 2017-05-26T17:00:00.000Z Updated: 2024-08-06T04:03:10.676Z Open on db.gcve.eu Reference links https://contao.org/en/news/contao-3_2_19.html https://contao.org/en/news/directory-traversal-vulnerability-cve-2015-0269.html https://contao.org/en/news/contao-3_4_4.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-1860`	vulnerable	2026-06-08 05:05:26.450461	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-1297`	vulnerable	2026-06-08 05:00:48.510030	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2011-4335`	vulnerable	2026-06-08 04:59:30.715244	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.