CVE-2026-55825 | Low | 3.1 | 2026-07-31 | Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachment identifier contai… |
CVE-2026-57232 | Low | 3.1 | 2026-07-31 | Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configured RSS feed URLs fro… |
CVE-2026-55824 | Low | 2.6 | 2026-07-31 | Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's cr… |
CVE-2025-65961 | Low | 3.3 | 2025-11-25 | Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output tha… |
CVE-2025-65960 | Medium | 6.6 | 2025-11-25 | Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of t… |
CVE-2025-57759 | Medium | 4.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be able to edit field… |
CVE-2025-57758 | Medium | 4.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is… |
CVE-2025-57757 | Medium | 5.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items… |
CVE-2025-57756 | Medium | 5.3 | 2025-08-28 | Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragmen… |
CVE-2025-29790 | Medium | 5.4 | 2025-03-18 | Contao is an Open Source CMS. Users can upload SVG files with malicious code, which is then executed in the back end and/or front end. This vulnerability is fi… |
CVE-2024-45965 | Medium | 6.4 | 2024-10-02 | Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and… |
CVE-2024-45604 | Medium | 4.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions authenticated users in the back end can list files outside the document root in the file selector widget. Us… |
CVE-2024-45398 | High | 8.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute them on the server. U… |
CVE-2024-45612 | Medium | 5.3 | 2024-09-17 | Contao is an Open Source CMS. In affected versions an untrusted user can inject insert tags into the canonical tag, which are then replaced on the web page (fr… |
CVE-2024-30262 | Medium | 5.9 | 2024-04-09 | Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the passwor… |
CVE-2024-28235 | High | 8.3 | 2024-04-09 | Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protec… |
CVE-2024-28234 | Medium | 4.3 | 2024-04-09 | Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via… |
CVE-2024-28191 | Low | 3.1 | 2024-04-09 | Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in f… |
CVE-2024-28190 | Medium | 5.4 | 2024-04-09 | Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filena… |
CVE-2018-5478 | Medium | 6.1 | 2023-09-21 | Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension. |
CVE-2023-36806 | Medium | 6.5 | 2023-07-25 | Contao is an open source content management system. Starting in version 4.0.0 and prior to versions 4.9.42, 4.13.28, and 5.1.10, it is possible for untrusted b… |
CVE-2023-29200 | Medium | 4.3 | 2023-04-25 | Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file m… |
CVE-2022-24899 | High | 7.2 | 2022-05-06 | Contao is a powerful open source CMS that allows you to create professional websites and scalable web applications. In versions of Contao prior to 4.13.3 it is… |
CVE-2022-26265 | Critical | 9.8 | 2022-03-18 | Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter. |
CVE-2021-35955 | Medium | 4.8 | 2021-08-12 | Contao >=4.0.0 allows backend XSS via HTML attributes to an HTML field. Fixed in 4.4.56, 4.9.18, 4.11.7. |
CVE-2021-37627 | High | 8.0 | 2021-08-11 | Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain privileged rights in t… |
CVE-2021-37626 | High | 7.2 | 2021-08-11 | Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by enterin… |
CVE-2021-35210 | Medium | 6.1 | 2021-06-23 | Contao 4.5.x through 4.9.x before 4.9.16, and 4.10.x through 4.11.x before 4.11.5, allows XSS. It is possible to inject code into the tl_log table that will be… |
CVE-2020-25768 | Medium | 5.3 | 2020-10-07 | Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms whic… |
CVE-2018-10125 | Medium | 6.1 | 2020-03-16 | Contao before 4.5.7 has XSS in the system log. |
CVE-2012-4383 | High | 8.8 | 2020-01-29 | contao prior to 2.11.4 has a sql injection vulnerability |
CVE-2014-1860 | Critical | 9.8 | 2020-01-08 | Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities |
CVE-2019-19745 | High | 8.8 | 2019-12-17 | Contao 4.0 through 4.8.5 allows PHP local file inclusion. A back end user with access to the form generator can upload arbitrary files and execute them on the… |
CVE-2019-19714 | Medium | 5.3 | 2019-12-17 | Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be replaced when the… |
CVE-2019-19712 | Medium | 5.3 | 2019-12-17 | Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have not been enabled for… |
CVE-2019-11512 | Critical | 9.8 | 2019-07-09 | Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5. |
CVE-2017-16558 | Critical | 9.8 | 2019-04-25 | Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module. |
CVE-2019-10643 | Critical | 9.8 | 2019-04-17 | Contao 4.7 allows Use of a Key Past its Expiration Date. |
CVE-2019-10642 | High | 8.8 | 2019-04-17 | Contao 4.7 allows CSRF. |
CVE-2019-10641 | Critical | 9.8 | 2019-04-17 | Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password. |
CVE-2018-20028 | Medium | 6.5 | 2019-04-17 | Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control. |
CVE-2017-10993 | High | 8.8 | 2017-07-21 | Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Direct… |
CVE-2015-0269 | Medium | 4.3 | 2017-05-26 | Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file… |
CVE-2012-1297 | | | 2012-03-19 | Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the a… |
CVE-2011-4335 | | | 2011-11-28 | Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to… |
CVE-2011-0508 | | | 2011-01-20 | Cross-site scripting (XSS) vulnerability in system/modules/comments/Comments.php in Contao CMS 2.9.2, and possibly other versions before 2.9.3, allows remote a… |