contao/contao Security Advisories for 4.10.0-RC1 (11)
-
Cross-site scripting in the frontend search results (see GHSA-h57j-5f5m-789v)
Affected version: >=4.9.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Unrestricted activation email resending (see GHSA-mfxh-vp55-7gc6)
Affected version: >=4.1.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)
Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Cross-site request forgery in custom backend actions (see GHSA-9ff2-p842-45wq)
Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
Exposure of sensitive information through a stale search index (see GHSA-x2rp-9qf7-2fmq)
Affected version: >=4.0.0,<5.3.50|>=5.4.0,<5.7.12
Reported by:
FriendsOfPHP/security-advisories -
[MEDIUM] Contao discloses sensitive information in the front end search index
PKSA-34p6-239r-z7w2 CVE-2025-57756 GHSA-2xmj-8wmq-7475
Affected version: >=5.4.0-RC1,<5.6.1|>=5.0.0-RC1,<5.3.38|>=4.9.14,<4.13.56
Reported by:
GitHub -
[MEDIUM] Cross site scripting via HTML attributes in the back end
PKSA-rc7z-49pc-5drp CVE-2021-35955 GHSA-hr3h-x6gq-rqcp
Affected version: >=4.0.0,<4.4.56|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.8.0|>=4.8.0,<4.9.0|>=4.9.0,<4.9.18|>=4.10.0,<4.11.0|>=4.11.0,<4.11.7
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[MEDIUM] PHP file inclusion via insert tags
PKSA-33hj-wh6g-5wzq CVE-2021-37626 GHSA-r6mv-ppjc-4hgr
Affected version: >=4.0.0,<4.4.56|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.8.0|>=4.8.0,<4.9.0|>=4.9.0,<4.9.18|>=4.10.0,<4.11.0|>=4.11.0,<4.11.7
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[HIGH] Privilege escalation with the form generator
PKSA-vfyp-1pdz-qxfn CVE-2021-37627 GHSA-hq5m-mqmx-fw6m
Affected version: >=4.0.0,<4.4.56|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.8.0|>=4.8.0,<4.9.0|>=4.9.0,<4.9.18|>=4.10.0,<4.11.0|>=4.11.0,<4.11.7
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[MEDIUM] Cross-site scripting (XSS) vulnerability in the system log
PKSA-vwzw-wjqk-61c9 CVE-2021-35210 GHSA-h58v-c6rf-g9f7
Affected version: >=4.5.0,<4.9.16|>=4.10.0,<4.11.0|>=4.11.0,<4.11.5
Reported by:
FriendsOfPHP/security-advisories, GitHub -
[MEDIUM] Insert tag injection in front end forms
PKSA-1cjk-ccfw-jwsc CVE-2020-25768 GHSA-f7wm-x4gw-6m23
Affected version: >=4.0.0,<4.4.52|>=4.5.0,<4.6.0|>=4.6.0,<4.7.0|>=4.7.0,<4.8.0|>=4.8.0,<4.9.0|>=4.9.0,<4.9.6|>=4.10.0,<4.10.1
Reported by:
FriendsOfPHP/security-advisories, GitHub