Contao Cms
Vendor:
First CVE: Jan 20, 2011 · Active for 15 years
11
Total CVEs
More Total CVEs than 90% of tracked products
2.2
Avg CVEs / Year
Higher CVE frequency than 76% of tracked products
7.5
Avg CVSS
Higher Avg CVSS than 63% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Contao Cms over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 20, 2011
15 years ago
Most Recent CVE
Jan 8, 2020
2,392 days ago
CVE Severity & Scoring
Contao Cms11 CVEs
45%
18%
36%
All CVEs352,785 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local0 (0.0%)
Network8 (72.7%)
Unknown3 (27.3%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low8 (72.7%)
High0 (0.0%)
Unknown3 (27.3%)
User Interaction
None7 (63.6%)
Unknown3 (27.3%)
Required1 (9.1%)
Privileges Required
Low3 (27.3%)
High0 (0.0%)
None5 (45.5%)
Unknown3 (27.3%)
Top CVEs
Signals from CVEs in this product scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-1297MEDIUM Multiple cross-site request forgery (CSRF) vulnerabilities in main.php in Contao (formerly TYPOlight) 2.11.0 and earlier allow remote attackers to hijack the authentication of admi | Mar 19, 2012 | 6.8 | 32 | NO | YES |
CVE-2017-16558CRITICAL Contao 3.0.0 to 3.5.30 and 4.0.0 to 4.4.7 contains an SQL injection vulnerability in the back end as well as in the listing module. | Apr 25, 2019 | 9.8 | 31 | NO | NO |
CVE-2019-10643CRITICAL Contao 4.7 allows Use of a Key Past its Expiration Date. | Apr 17, 2019 | 9.8 | 31 | NO | NO |
CVE-2019-10641CRITICAL Contao before 3.5.39 and 4.x before 4.7.3 has a Weak Password Recovery Mechanism for a Forgotten Password. | Apr 17, 2019 | 9.8 | 31 | NO | NO |
CVE-2019-10642HIGH Contao 4.7 allows CSRF. | Apr 17, 2019 | 8.8 | 28 | NO | NO |
CVE-2017-10993HIGH Contao before 3.5.28 and 4.x before 4.4.1 allows remote attackers to include and execute arbitrary local PHP files via a crafted parameter in a URL, aka Directory Traversal. | Jul 21, 2017 | 8.8 | 28 | NO | NO |
CVE-2014-1860CRITICAL Contao CMS through 3.2.4 has PHP Object Injection Vulnerabilities | Jan 8, 2020 | 9.8 | 25 | NO | NO |
CVE-2011-4335MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in Contao before 2.10.2 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php in a (1) te | Nov 28, 2011 | 4.3 | 25 | NO | YES |
CVE-2018-20028MEDIUM Contao 3.x before 3.5.37, 4.4.x before 4.4.31 and 4.6.x before 4.6.11 has Incorrect Access Control. | Apr 17, 2019 | 6.5 | 23 | NO | NO |
CVE-2015-0269MEDIUM Directory traversal vulnerability in Contao before 3.2.19, and 3.4.x before 3.4.4 allows remote authenticated "back end" users to view files outside their file mounts or the docume | May 26, 2017 | 4.3 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (11 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
2 CVEs
18.2% of CVEs· 87th percentile
Social Chatter
Signals from CVEs in this product scope (11 CVEs).
Media Mentions
Signals from CVEs in this product scope (11 CVEs).
Top CNAs Publishing CVEs For Contao Cms
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 4.7.0 | 2 | 9.3 | 0.9% | 0 | 0 |
| 4.4.0 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.3.9 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.3.8 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.3.7 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.3.6 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.3.5 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.3.3 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.3.2 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.3.11 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.3.10 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.3.1 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.3.0 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.2.5 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.2.4 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.2.3 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.2.2 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.2.1 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.2.0 | 1 | 8.8 | 2.0% | 0 | 0 |
| 4.1.3 | 1 | 8.8 | 2.0% | 0 | 0 |