Vulnerabilities in Contao
32 resultsCVE-2026-107845CRITICALContao: Cross-site scripting in the comments bundleEPSS 0.3%CVE-2026-107843MEDIUMContao: The registration module re-sends activation mails on any unauthenticated POST, with no throttle and no captcha checkEPSS 0.3%CVE-2026-107842MEDIUMContao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabledEPSS 0.3%CVE-2025-57759MEDIUMContao has improper privilege management for page and article fieldsEPSS 0.3%CVE-2025-57758MEDIUMContao has improper access control in the back end votersEPSS 0.3%CVE-2026-55824LOWContao crawler leaks auth credentials to external hostsEPSS 0.2%CVE-2025-29790MEDIUMContao allows cross-site scripting through SVG uploadsEPSS 0.2%CVE-2026-107851MEDIUMContao: Improper access control in the table access voterEPSS 0.2%CVE-2026-107850MEDIUMContao: Improper access control in the preview links moduleEPSS 0.2%CVE-2025-65960MEDIUMContao is vulnerable to remote code execution in template closuresEPSS 0.2%CVE-2025-65961LOWContao is vulnerable to cross-site scripting in templatesEPSS 0.2%CVE-2026-107848LOWContao: Cross-site request forgery in custom backend actionsEPSS 0.1%