Approved changes feed: RSS · Atom
cpe:2.3:a:contao:contao:-:*:*:*:*:*:*:*
part: a version: - update: *
| Vendor | Contao (2e1f0faf-98d6-5a32-b645-9644099d89c5) |
|---|---|
| Product | Contao (c5350457-7770-5fc6-864f-7b149c4d3f20) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/contao/contao |
purl2cpe | 2026-06-01 10:16:56.190023 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-45398 |
vulnerable | 2026-06-08 06:48:06.062260 |
Remote command execution through file upload in contao/core-bundle
HIGH (8.3)
Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. Users are advised to update to Contao 4.13.49, 5.3.15 or 5.4.3. Users unable to update are advised to configure their web server so it does not execute PHP files and other scripts in the Contao file upload directory.
Published: 2024-09-17T19:56:00.791Z
Updated: 2024-09-18T13:17:36.013Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-36806 |
vulnerable | 2026-06-08 06:08:13.515603 |
Contao cross site scripting vulnerability via input unit widget
MEDIUM (6.5)
Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted backend users to inject malicious code into headline fields in the back end, which will be executed both in the element preview (back end) and on the website (front end). Installations are only affected if there are untrusted back end users who have the rights to modify headline fields, or other fields using the input unit widget. Contao 4.9.42, 4.13.28, and 5.1.10 have a patch for this issue. As a workaround, disable the login for all untrusted back end users.
Published: 2023-07-25T18:47:34.415Z
Updated: 2025-02-13T16:56:24.200Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.