Contao 4.x allows SQL Injection. Fixed in Contao 4.4.39 and Contao 4.7.5.
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HContao
APPContao4.0.0 – 4.4.39 (excl.)4.5.0 – 4.7.5 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
SQLi
CWE
Related vulnerabilities
CVE-2022-26265CRITICAL9.8PL ✓same product
RCE poprzez command injection w parametrze php_cli w Contao Managed Edition
CVE-2024-45398HIGH8.3same product
Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload ...
CVE-2024-28235HIGH8.3same product
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 an...
CVE-2022-24899HIGH7.2same product
Contao is a powerful open source CMS that allows you to create professional websites and scalable web applicat...
CVE-2021-37627HIGH8.0same product
Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versi...