contao contao

Name: contao contao
Brand: contao

productUS

cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

2critical6high19medium0low

updated 2026-10-28

vulnerabilities (32)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2022-26265US	critical9.8	30.4% (98th)	Exploit	no fix	2022-03-18	= 1.5.0
CVE-2022-24899US	medium6.1	4.48% (91st)	—	no fix	2022-05-06	4.13.0 → 4.13.2
CVE-2019-11512US	critical9.8	1.46% (73rd)	—	4.7.5	2019-07-09	2 versions
CVE-2021-37626US	high7.2	1.25% (69th)	—	4.9.18	2021-08-11	12 versions
CVE-2019-19745US	high8.8	1.11% (66th)	—	no fix	2019-12-17	9 versions
CVE-2021-37627US	high7.2	1.02% (63rd)	—	4.11.7	2021-08-11	12 versions
CVE-2012-4383US	high8.8	0.92% (60th)	—	2.11.4	2020-01-29	< 2.11.4
CVE-2019-19712US	medium5.3OT elevated	0.88% (59th)	—	no fix	2019-12-17	9 versions
CVE-2018-10125US	medium6.1	0.84% (58th)	—	no fix	2020-03-16	7 versions
CVE-2020-25768US	medium5.3	0.82% (57th)	—	4.4.52	2020-10-07	3 versions
CVE-2019-19714US	medium5.3	0.82% (57th)	—	no fix	2019-12-17	2 versions
CVE-2023-29200US	medium6.5	0.80% (56th)	—	5.1.4	2023-04-25	3 versions
CVE-2021-35210US	medium6.1	0.74% (54th)	—	4.9.16	2021-06-23	2 versions
CVE-2024-28235US	medium6.5	0.71% (53rd)	—	5.3.4	2024-04-09	2 versions
CVE-2023-36806US	medium5.4	0.64% (50th)	—	4.9.42	2023-07-25	3 versions
CVE-2024-28234US	medium4.7	0.57% (47th)	—	4.13.40	2024-04-09	2 versions
CVE-2021-35955US	medium4.8	0.56% (46th)	—	4.9.18	2021-08-12	3 versions
CVE-2024-45398US	high8.8	0.53% (45th)	—	5.3.15	2024-09-17	3 versions
CVE-2024-28190US	medium5.4	0.50% (43rd)	—	5.3.4	2024-04-09	2 versions
CVE-2024-30262US	high7.1	0.50% (43rd)	—	4.13.40	2024-04-09	< 4.13.40
CVE-2024-28191US	medium5.4	0.50% (42nd)	—	5.3.4	2024-04-09	2 versions
CVE-2024-45604US	medium4.3	0.43% (37th)	—	4.13.49	2024-09-17	< 4.13.49
CVE-2018-5478US	medium6.1	0.41% (36th)	—	3.5.32	2023-09-21	3.0.0 → 3.5.32
CVE-2024-45965US	medium5.4	0.34% (27th)	—	4.13.54	2024-10-02	3 versions
CVE-2025-57757US	—	0.30% (23rd)	—	5.3.38	2025-08-28	2 versions
CVE-2024-45612US	medium5.3	0.30% (22nd)	—	4.13.49	2024-09-17	3 versions
CVE-2025-57756US	—	0.29% (21st)	—	5.6.1	2025-08-28	4 versions
CVE-2025-57759US	—	0.25% (16th)	—	5.6.1	2025-08-28	2 versions
CVE-2025-57758US	—	0.25% (16th)	—	5.6.1	2025-08-28	2 versions
CVE-2025-29790US	medium5.4	0.22% (13th)	—	4.13.53	2025-03-18	3 versions
CVE-2025-65960US	—	0.19% (9th)	—	5.6.5	2025-11-25	3 versions
CVE-2025-65961US	medium4.8	0.18% (7th)	—	5.6.5	2025-11-25	3 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')11 CVEs
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')4 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor3 CVEs
CWE-434Unrestricted Upload of File with Dangerous Type3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2 CVEs
CWE-269Improper Privilege Management2 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')2 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE32 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan