Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)

PKSA-snk8-7c3n-1x4z

Affected version: >=4.9.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)

PKSA-wrr4-414y-fqmj

Affected version: >=4.1.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Non-admin users can self-grant permissions that implicitly make them administrators (see GHSA-r9qp-pqx5-8369)

PKSA-335s-36s8-mdj4

Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)

PKSA-4788-1fwx-c4gc

Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)

PKSA-cvfh-n5dv-w5t9

Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Path traversal in the images controller (see GHSA-mrvp-7wmx-5m4h)

PKSA-zm5t-426r-gfpx

Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Improper access control in the CSV import wizard (see GHSA-23w9-4pg3-xwm3)

PKSA-t5k3-41dk-f7y5

Affected version: >=5.0.0,<5.3.50|>=5.4.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Improper access control in the preview links module (see GHSA-q6wp-fr43-gm9v)

PKSA-yksm-8fg2-dsvs

Affected version: >=5.7.1,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Improper access control in the table access voter (see GHSA-5974-gfqc-wrcm)

PKSA-xtw6-fy62-6vn3

Affected version: >=5.7.0,<5.7.12

Reported by:
FriendsOfPHP/security-advisories

Server-side request forgery (SSRF) via unvalidated RSS feed URLs

PKSA-yx24-z15d-x2k7 CVE-2026-57232

Affected version: >=5.3.35,<5.3.48|>=5.4.0,<5.7.9

Reported by:
FriendsOfPHP/security-advisories

[LOW] Path traversal in the jobs module

PKSA-4ps2-832y-6pns CVE-2026-55825 GHSA-grm4-wm43-9jh5

Affected version: >=5.7.0,<5.7.7

Reported by:
FriendsOfPHP/security-advisories, GitHub

[LOW] Credentials disclosure in the crawler

PKSA-f8tt-pn3h-s2tw CVE-2026-55824 GHSA-3mr9-p497-58f6

Affected version: >=4.13.0,<5.3.47|>=5.4.0,<5.7.7

Reported by:
FriendsOfPHP/security-advisories, GitHub

[LOW] Contao is vulnerable to cross-site scripting in templates

PKSA-3p5h-vgz7-458z CVE-2025-65961 GHSA-68q5-78xp-cwwc

Affected version: >=5.4.0-RC1,<5.6.5|>=5.0.0-RC1,<5.3.42|>=4.0.0,<4.13.57

Reported by:
GitHub

[MEDIUM] Contao is vulnerable to remote code execution in template closures

PKSA-wjhx-cdbz-9x61 CVE-2025-65960 GHSA-98vj-mm79-v77r

Affected version: >=5.4.0-RC1,<5.6.5|>=5.0.0-RC1,<5.3.42|>=4.0.0,<4.13.57

Reported by:
GitHub

[MEDIUM] Contao does not properly manage privileges for page and article fields

PKSA-4m99-84h8-dntz CVE-2025-57759 GHSA-qqfq-7cpp-hcqj

Affected version: >=5.4.0-RC1,<5.6.1|>=5.3.0,<5.3.38

Reported by:
GitHub

[MEDIUM] Contao can disclose sensitive information in the news module

PKSA-v6p5-ssqr-1zcw CVE-2025-57757 GHSA-w53m-gxvg-vx7p

Affected version: >=5.4.0-RC1,<5.6.1|>=5.0.0-RC1,<5.3.38

Reported by:
GitHub

[MEDIUM] Contao discloses sensitive information in the front end search index

PKSA-66g4-yhz3-k3zh CVE-2025-57756 GHSA-2xmj-8wmq-7475

Affected version: >=5.4.0-RC1,<5.6.1|>=5.0.0-RC1,<5.3.38|>=4.9.14,<4.13.56

Reported by:
GitHub

[MEDIUM] Contao applies improper access control in the back end voters

PKSA-c2g8-xqxr-4cjw CVE-2025-57758 GHSA-7m47-r75r-cx8v

Affected version: >=5.4.0-RC1,<5.6.1|>=5.0.0,<5.3.38

Reported by:
GitHub

[MEDIUM] Contao Vulnerable to Cross-Site Scripting (XSS) through SVG uploads

PKSA-pmyp-m45j-62p1 CVE-2025-29790 GHSA-vqqr-fgmh-f626

Affected version: >=5.4.0,<5.5.6|>=5.3.0,<5.3.30|>=4.0.0,<4.13.54

Reported by:
GitHub

[MEDIUM] Contao affected by insert tag injection via canonical URL

PKSA-8psg-sb44-9n6y CVE-2024-45612 GHSA-2xpq-xp6c-5mgj

Affected version: >=5.4.0,<5.4.3|>=5.0.0,<5.3.15|>=4.13.0,<4.13.49

Reported by:
GitHub

[MEDIUM] Contao affected by directory traversal in the file selector widget

PKSA-gkh9-zxxg-dpvd CVE-2024-45604 GHSA-4p75-5p53-65m9

Affected version: <4.13.49

Reported by:
GitHub

[HIGH] Contao affected by remote command execution through file upload

PKSA-5k7g-byhd-8xrm CVE-2024-45398 GHSA-vm6r-j788-hjh5

Affected version: >=5.4.0,<5.4.3|>=5.0.0,<5.3.15|>=4.0.0,<4.13.49

Reported by:
GitHub

[LOW] Contao: Unencoded insert tags in the frontend

PKSA-rk65-kfm6-21d9 CVE-2024-28191 GHSA-747v-52c4-8vj8

Affected version: >=5.0.0-RC1,<5.3.4|>=4.0.0,<4.13.40

Reported by:
GitHub

[MEDIUM] Contao: Cross site scripting in the file manager

PKSA-bxmw-zt4x-f182 CVE-2024-28190 GHSA-v24p-7p4j-qvvf

Affected version: >=5.0.0-RC1,<5.3.4|>=4.0.0,<4.13.40

Reported by:
GitHub

[MEDIUM] Contao: Remember-me tokens will not be cleared after a password change

PKSA-7hz7-f163-3mdr CVE-2024-30262 GHSA-r4r6-j2j3-7pp5

Affected version: <4.13.40

Reported by:
GitHub

[HIGH] Contao: Possible cookie sharing with external domains while checking protected pages for broken links

PKSA-g1qg-mn7d-638g CVE-2024-28235 GHSA-9jh5-qf84-x6pr

Affected version: >=5.0.0-RC1,<5.3.4|>=4.9.0,<4.13.40

Reported by:
GitHub

[MEDIUM] Cross site scripting via input unit widget

PKSA-kc45-s13v-qqqk CVE-2023-36806 GHSA-4gpr-p634-922x

Affected version: >=5.0.0,<5.1.10|>=4.10.0,<4.13.28|>=4.0.0,<4.9.42

Reported by:
GitHub

Directory traversal vulnerability in the file manager

PKSA-wth6-rm9c-yh3w CVE-2023-29200

Affected version: >=4.9.0,<4.9.40|>=4.13.0,<4.13.21|>=5.1.0,<5.1.4

Reported by:
FriendsOfPHP/security-advisories

[HIGH] Cross site scripting via canonical URL

PKSA-jc9p-83z1-zst8 CVE-2022-24899 GHSA-m8x6-6r63-qvj2

Affected version: >=4.13.0,<4.13.3

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] Cross site scripting via HTML attributes in the back end

PKSA-s6nh-jp39-2w3w CVE-2021-35955 GHSA-hr3h-x6gq-rqcp

Affected version: >=4.0.0,<4.4.56|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.8.0|>=4.8.0,<4.9.0|>=4.9.0,<4.9.18|>=4.10.0,<4.11.0|>=4.11.0,<4.11.7

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] PHP file inclusion via insert tags

PKSA-dqg4-bv6y-y9k1 CVE-2021-37626 GHSA-r6mv-ppjc-4hgr

Affected version: >=4.0.0,<4.4.56|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.8.0|>=4.8.0,<4.9.0|>=4.9.0,<4.9.18|>=4.10.0,<4.11.0|>=4.11.0,<4.11.7

Reported by:
FriendsOfPHP/security-advisories, GitHub

[HIGH] Privilege escalation with the form generator

PKSA-6972-2czp-n9y4 CVE-2021-37627 GHSA-hq5m-mqmx-fw6m

Affected version: >=4.0.0,<4.4.56|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.8.0|>=4.8.0,<4.9.0|>=4.9.0,<4.9.18|>=4.10.0,<4.11.0|>=4.11.0,<4.11.7

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] Cross-site scripting (XSS) vulnerability in the system log

PKSA-ztzv-8k57-rm9h CVE-2021-35210 GHSA-h58v-c6rf-g9f7

Affected version: >=4.5.0,<4.9.16|>=4.10.0,<4.11.0|>=4.11.0,<4.11.5

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] Insert tag injection in front end forms

PKSA-bn7k-dnct-c6sd CVE-2020-25768 GHSA-f7wm-x4gw-6m23

Affected version: >=4.0.0,<4.4.52|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.8.0|>=4.8.0,<4.9.0|>=4.9.0,<4.9.6|>=4.10.0,<4.10.1

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] Insert tag injection in the login module

PKSA-hg6f-pdnr-w5hp CVE-2019-19714 GHSA-jc43-qrrp-98f5

Affected version: >=4.8.4,<4.8.6

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] Information disclosure in the back end

PKSA-kmq8-295w-n5p1 CVE-2019-19712 GHSA-4mvc-qc5w-v5qr

Affected version: >=4.0.0,<4.4.46|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.8.0|>=4.8.0,<4.8.6

Reported by:
FriendsOfPHP/security-advisories, GitHub

[HIGH] Unrestricted file uploads

PKSA-n9hp-vpy3-25rz CVE-2019-19745 GHSA-wjx8-cgrm-hh8p

Affected version: >=4.0.0,<4.4.46|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.8.0|>=4.8.0,<4.8.6

Reported by:
FriendsOfPHP/security-advisories, GitHub

[CRITICAL] SQL injection vulnerabililty in the file manager search filter

PKSA-6dhc-y3rp-wnjp CVE-2019-11512 GHSA-vq59-x6mq-4wgw

Affected version: >=4.1.0,<4.4.39|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.7.5

Reported by:
FriendsOfPHP/security-advisories, GitHub

[HIGH] The CSRF token check can be bypassed

PKSA-gf4r-bjyy-3fwt CVE-2019-10642 GHSA-hwmh-9jj9-8c9c

Affected version: >=4.7.0,<4.7.3

Reported by:
FriendsOfPHP/security-advisories, GitHub

[CRITICAL] Confirming an opt-in token does not invalidate previous opt-in tokens

PKSA-pnr9-2f76-g9z8 CVE-2019-10643 GHSA-j99g-qjvx-995g

Affected version: >=4.7.0,<4.7.3

Reported by:
FriendsOfPHP/security-advisories, GitHub

[CRITICAL] Existing sessions are not correctly invalidated when a user changes their password

PKSA-62kn-sxm4-zf9x CVE-2019-10641 GHSA-vcgg-hp4r-87gx

Affected version: >=4.0.0,<4.4.37|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.7.3

Reported by:
FriendsOfPHP/security-advisories, GitHub

[MEDIUM] Cross-site scripting (XSS) vulnerability in the system log of the back end

PKSA-7xh8-fvvz-jkj9 CVE-2018-10125 GHSA-pj4j-287j-f742

Affected version: >=4.0.0,<4.4.18|>=4.5.0,<4.5.8

Reported by:
FriendsOfPHP/security-advisories, GitHub

[CRITICAL] SQL injection vulnerabililty in the back end search filter

PKSA-hhsz-rqf9-rpm4 CVE-2017-16558 GHSA-w38g-hj45-mjjp

Affected version: >=4.0.0,<4.4.8

Reported by:
FriendsOfPHP/security-advisories, GitHub

[HIGH] A logged in back end user can include arbitrary existing PHP files by manipulating an URL parameter

PKSA-bm99-nmx5-wsq1 CVE-2017-10993 GHSA-x5g4-crxq-qxjx

Affected version: >=4.0.0,<4.4.1

Reported by:
FriendsOfPHP/security-advisories, GitHub