CVE-2025-65961: fallo de gravedad baja en contao
Contao is vulnerable to cross-site scripting in templates
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 3.3epss 0.2%
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, it is possible to inject code into the template output that will be executed in the browser in the front end and back end. This issue has been patched in versions 4.13.57, 5.3.42, and 5.6.5. A workaround for this issue involves not using the affected templates or patch them manually.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
Productos afectados
contao · contaoCVEs relacionadas — contao
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-24899HIGHCross site scripting via canonical tagEPSS 4.5%CVE-2021-37626HIGHPHP file inclusion via insert tagsEPSS 1.3%CVE-2021-37627HIGHPrivilege escalation via form generatorEPSS 1.0%CVE-2012-4383—CVE-2012-4383EPSS 0.9%CVE-2023-29200MEDIUMcontao/core-bundle has path traversal vulnerability in the file managerEPSS 0.8%CVE-2024-28235HIGHContao possible cookie sharing with external domains while checking protected pages for broken linksEPSS 0.7%