Login Request a demo
CO
Product
contao
by contao · last CVE Oct 9, 2026
42
CVEs
0
On KEV
9.8
Max CVSS
7
New 30D
Vulnerabilities42In the news0Timeline
Severity mix
Critical 3High 6Medium 29Low 4
Severity
All severities42Critical3High6Medium29Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add contao to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-45398
8.8
1%
Sep 17
Remote command execution through file upload in contao/core-bundle
Affected: >=4.0.0, < 4.13.49; >= 5.0.0, < 5.3.15; >= 5.4.0, < 5.4.3
CVE-2012-4383
8.8
1%
Jan 29
contao prior to 2.11.4 has a sql injection vulnerability
Affected: before 2.11.4
CVE-2019-19745
8.8
1%
Dec 17
Contao 4.0 through 4.8.5 allows PHP local file inclusion
Affected: 4.4 through 4.4.45; 4.8 through 4.8.5; 4.0; 4.1; 4.2; 4.3; +3 more
CVE-2021-37627
7.2
1%
Aug 11
Privilege escalation via form generator
Affected: < 4.4.56; >= 4.5.0, < 4.9.18; >= 4.10.0, < 4.11.7
CVE-2021-37626
7.2
1%
Aug 11
PHP file inclusion via insert tags
Affected: >= 4.0.0, < 4.4.56; >= 4.5.0, < 4.9.18; >= 4.10.0, < 4.11.7
CVE-2024-30262
7.1
0%
Apr 9
Contao's remember-me tokens will not be cleared after a password change
Affected: < 4.13.40
Showing 6