Approved changes feed: RSS · Atom
cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Contao (2e1f0faf-98d6-5a32-b645-9644099d89c5) |
|---|---|
| Product | Contao (c5350457-7770-5fc6-864f-7b149c4d3f20) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/contao/contao |
purl2cpe | 2026-06-01 10:16:56.190021 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-65961 |
vulnerable | 2026-06-08 07:39:21.102010 |
Contao is vulnerable to cross-site scripting in templates
LOW (3.3)
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually.
Published: 2025-11-25T19:06:37.395Z
Updated: 2025-11-25T19:29:04.630Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-65960 |
vulnerable | 2026-06-08 07:39:21.101560 |
Contao is vulnerable to remote code execution in template closures
MEDIUM (6.6)
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
Published: 2025-11-25T18:54:48.897Z
Updated: 2025-11-25T20:00:14.687Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-57759 |
vulnerable | 2026-06-08 07:33:16.078232 |
Contao has improper privilege management for page and article fields
MEDIUM (4.3)
Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.
Published: 2025-08-28T16:32:59.022Z
Updated: 2025-08-28T17:16:55.904Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-57758 |
vulnerable | 2026-06-08 07:33:16.077846 |
Contao has improper access control in the back end voters
MEDIUM (4.3)
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.
Published: 2025-08-28T16:32:38.664Z
Updated: 2025-08-28T17:20:01.087Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-57757 |
vulnerable | 2026-06-08 07:33:16.077590 |
Contao discloses information in the news module
MEDIUM (5.3)
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not adding protected news archives to the news feed page.
Published: 2025-08-28T16:32:03.487Z
Updated: 2025-08-28T17:48:36.124Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-57756 |
vulnerable | 2026-06-08 07:33:16.077273 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-29790 |
vulnerable | 2026-06-08 07:14:56.593868 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45965 |
vulnerable | 2026-06-08 06:48:09.878855 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45612 |
vulnerable | 2026-06-08 06:48:08.726319 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45604 |
vulnerable | 2026-06-08 06:48:08.718012 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45398 |
vulnerable | 2026-06-08 06:48:06.063064 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-30262 |
vulnerable | 2026-06-08 06:35:29.368272 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28235 |
vulnerable | 2026-06-08 06:33:26.778371 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28234 |
vulnerable | 2026-06-08 06:33:26.777962 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28191 |
vulnerable | 2026-06-08 06:33:26.709619 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-28190 |
vulnerable | 2026-06-08 06:33:26.708966 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-36806 |
vulnerable | 2026-06-08 06:08:13.516903 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-29200 |
vulnerable | 2026-06-08 06:02:39.121209 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-24899 |
vulnerable | 2026-06-08 05:41:44.858024 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-37627 |
vulnerable | 2026-06-08 05:32:54.510955 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-37626 |
vulnerable | 2026-06-08 05:32:54.503446 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-35955 |
vulnerable | 2026-06-08 05:32:49.447761 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-35210 |
vulnerable | 2026-06-08 05:32:48.524928 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-25768 |
vulnerable | 2026-06-08 05:23:49.397133 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19745 |
vulnerable | 2026-06-08 05:13:23.519563 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-19712 |
vulnerable | 2026-06-08 05:13:23.481688 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-11512 |
vulnerable | 2026-06-08 05:12:37.485613 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-5478 |
vulnerable | 2026-06-08 05:11:51.249286 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-10125 |
vulnerable | 2026-06-08 05:10:26.368675 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2012-4383 |
vulnerable | 2026-06-08 05:02:17.217236 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.