PatchFirst · Свежие уязвимости
За последние 30 дней в contao/core опубликовано уязвимостей: 0; в каталоге KEV: 0.
Уязвимостей: 9
PHP object injection vulnerability was identified in contao/core due to untrusted data being passed to `deserialize()` function.
contao/core versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are vulnerable to arbitrary code execution on the server due to insufficient input validation. In fact, attackers can remove or change pathconfig.php by entering a URL, meaning that the entire Contao installation will no longer be accessible or malicious code can be executed.
Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.
Contao before 4.5.7 has XSS in the system log.
contao prior to 2.11.4 has a sql injection vulnerability
Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password.
Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal.
Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the document root via unspecified vectors.
Cross-site scripting (XSS) vulnerability in flash/FlashMediaElement.as in MediaElement.js before 2.21.0, as used in WordPress before 4.5.2, allows remote attackers to inject arbitrary web script or HTML via an obfuscated form of the jsinitfunction parameter, as demonstrated by "jsinitfunctio%gn."
Сопоставьте установленный стек и версии со свежими базами уязвимостей.