Approved changes feed: RSS · Atom

cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*

part: a version: * update: *

VendorContao (2e1f0faf-98d6-5a32-b645-9644099d89c5)
ProductContao (c5350457-7770-5fc6-864f-7b149c4d3f20)
Edition*
Language*
Software edition*
Target software*
Target hardware*
Other*
NotesImported from purl2cpe mapping

PURL mappings

PURLSourceLast updated
pkg:github/contao/contao purl2cpe 2026-06-01 10:16:56.190021

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2025-65961 vulnerable 2026-06-08 07:39:21.102010 Contao is vulnerable to cross-site scripting in templates
LOW (3.3)
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually.
Published: 2025-11-25T19:06:37.395Z
Updated: 2025-11-25T19:29:04.630Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-65960 vulnerable 2026-06-08 07:39:21.101560 Contao is vulnerable to remote code execution in template closures
MEDIUM (6.6)
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves manually patching the Contao\Template::once() method.
Published: 2025-11-25T18:54:48.897Z
Updated: 2025-11-25T20:00:14.687Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-57759 vulnerable 2026-06-08 07:33:16.078232 Contao has improper privilege management for page and article fields
MEDIUM (4.3)
Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit fields of pages and articles without having the necessary permissions. This issue has been patched in versions 5.3.38 and 5.6.1. There are no workarounds.
Published: 2025-08-28T16:32:59.022Z
Updated: 2025-08-28T17:16:55.904Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-57758 vulnerable 2026-06-08 07:33:16.077846 Contao has improper access control in the back end voters
MEDIUM (4.3)
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.
Published: 2025-08-28T16:32:38.664Z
Updated: 2025-08-28T17:20:01.087Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-57757 vulnerable 2026-06-08 07:33:16.077590 Contao discloses information in the news module
MEDIUM (5.3)
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not adding protected news archives to the news feed page.
Published: 2025-08-28T16:32:03.487Z
Updated: 2025-08-28T17:48:36.124Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-57756 vulnerable 2026-06-08 07:33:16.077273 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2025-29790 vulnerable 2026-06-08 07:14:56.593868 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45965 vulnerable 2026-06-08 06:48:09.878855 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45612 vulnerable 2026-06-08 06:48:08.726319 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45604 vulnerable 2026-06-08 06:48:08.718012 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-45398 vulnerable 2026-06-08 06:48:06.063064 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-30262 vulnerable 2026-06-08 06:35:29.368272 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-28235 vulnerable 2026-06-08 06:33:26.778371 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-28234 vulnerable 2026-06-08 06:33:26.777962 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-28191 vulnerable 2026-06-08 06:33:26.709619 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2024-28190 vulnerable 2026-06-08 06:33:26.708966 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-36806 vulnerable 2026-06-08 06:08:13.516903 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2023-29200 vulnerable 2026-06-08 06:02:39.121209 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2022-24899 vulnerable 2026-06-08 05:41:44.858024 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-37627 vulnerable 2026-06-08 05:32:54.510955 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-37626 vulnerable 2026-06-08 05:32:54.503446 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-35955 vulnerable 2026-06-08 05:32:49.447761 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-35210 vulnerable 2026-06-08 05:32:48.524928 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2020-25768 vulnerable 2026-06-08 05:23:49.397133 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-19745 vulnerable 2026-06-08 05:13:23.519563 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-19712 vulnerable 2026-06-08 05:13:23.481688 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2019-11512 vulnerable 2026-06-08 05:12:37.485613 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-5478 vulnerable 2026-06-08 05:11:51.249286 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2018-10125 vulnerable 2026-06-08 05:10:26.368675 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2012-4383 vulnerable 2026-06-08 05:02:17.217236 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.