Log in Start free

Contao

Products

ProductCVEsExploitedLatest
Contao31–Oct 9, 2026

Exploited and recent CVEs

  • CVE-2026-107851 Medium 4.3 Contao: Improper access control in the table access voter 0.2%
  • CVE-2026-107850 Medium 4.3 Contao: Improper access control in the preview links module 0.2%
  • CVE-2026-107848 Low 3.5 Contao: Cross-site request forgery in custom backend actions 0.1%
  • CVE-2026-107845 Critical 9.3 Contao: Cross-site scripting in the comments bundle 0.3%
  • CVE-2026-107844 Medium 5.3 Contao: Path traversal in the images controller 0.3%
  • CVE-2026-107843 Medium 5.3 Contao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha check 0.3%
  • CVE-2026-107842 Medium 5.3 Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled 0.3%
  • CVE-2026-55825 Low 3.1 Contao: Possible path traversal in job download URIs 0.3%
  • CVE-2026-55824 Low 2.6 Contao crawler leaks auth credentials to external hosts 0.2%
  • CVE-2026-57232 Low 3.1 Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module 0.3%
  • CVE-2025-65961 Low 3.3 Contao is vulnerable to cross-site scripting in templates 0.2%
  • CVE-2025-65960 Medium 6.6 Contao is vulnerable to remote code execution in template closures 0.2%
  • CVE-2025-57759 Medium 4.3 Contao has improper privilege management for page and article fields 0.3%
  • CVE-2025-57758 Medium 4.3 Contao has improper access control in the back end voters 0.3%
  • CVE-2025-57757 Medium 5.3 Contao discloses information in the news module 0.3%
  • CVE-2025-57756 Medium 5.3 Contao discloses sensitive information in the front end search index 0.3%
  • CVE-2025-29790 Medium 4.8 Contao allows cross-site scripting through SVG uploads 0.2%
  • CVE-2024-45965 Medium 6.4 Contao before 5.5.6 allows XSS via an SVG document. This affects (in contao/core-bundle in Composer) 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6. 0.3%
  • CVE-2024-45604 Medium 4.3 Directory traversal in the file selector widget in contao/core-bundle 0.4%
  • CVE-2024-45398 High 8.3 Remote command execution through file upload in contao/core-bundle 0.5%
  • CVE-2024-45612 Medium 5.3 Insert tag injection via canonical URL in Contao 0.3%
  • CVE-2024-30262 Medium 5.9 Contao's remember-me tokens will not be cleared after a password change 0.6%
  • CVE-2024-28235 High 8.4 Contao possible cookie sharing with external domains while checking protected pages for broken links 0.7%
  • CVE-2024-28234 Medium 4.3 Contao has insufficient BBCode sanitizer 0.6%
  • CVE-2024-28191 Low 3.1 Contao may have unencoded insert tags in the frontend 0.5%
  • CVE-2024-28190 Medium 5.4 Contao core bundle vulnerable to cross site scripting in the file manager 0.5%
  • CVE-2023-36806 Medium 6.5 Contao cross site scripting vulnerability via input unit widget 0.6%
  • CVE-2023-29200 Medium 4.3 contao/core-bundle has path traversal vulnerability in the file manager 0.8%
  • CVE-2022-24899 High 7.2 Cross site scripting via canonical tag 4.5%
  • CVE-2021-37627 High 8.0 Privilege escalation via form generator 1.0%