Leo Feyer

11 exploits Active since Apr 2023
CVE-2024-28190 WRITEUP MEDIUM WRITEUP
Contao 4.0.0-4.13.39 - Stored Cross-Site Scripting via Filename Upload
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
CVSS 5.4
CVE-2024-28191 WRITEUP LOW WRITEUP
Contao 4.0.0-4.13.39 - Insert Tag Injection via Form Generator
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
CVSS 3.1
CVE-2024-28234 WRITEUP MEDIUM WRITEUP
Contao 2.0.0-4.13.39 and 5.0.0-5.3.3 - CSS Injection via BBCode in Comments
Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.
CVSS 4.3
CVE-2024-28235 WRITEUP HIGH WRITEUP
Contao 4.9.0-4.13.39 - Session Cookie Disclosure via Crawler External URL Requests
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
CVSS 8.3
CVE-2023-29200 WRITEUP MEDIUM WRITEUP
Contao <4.9.40, <4.13.21, <5.1.4 - Info Disclosure
Contao is an open source content management system. Prior to versions 4.9.40, 4.13.21, and 5.1.4, logged in users can list arbitrary system files in the file manager by manipulating the Ajax request. However, it is not possible to read the contents of these files. Users should update to Contao 4.9.40, 4.13.21 or 5.1.4 to receive a patch. There are no known workarounds.
CVSS 4.3
CVE-2024-28190 WRITEUP MEDIUM WRITEUP
Contao 4.0.0-4.13.39 - Stored Cross-Site Scripting via Filename Upload
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
CVSS 5.4
CVE-2024-28191 WRITEUP LOW WRITEUP
Contao 4.0.0-4.13.39 - Insert Tag Injection via Form Generator
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
CVSS 3.1
CVE-2024-28234 WRITEUP MEDIUM WRITEUP
Contao 2.0.0-4.13.39 and 5.0.0-5.3.3 - CSS Injection via BBCode in Comments
Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.
CVSS 4.3
CVE-2024-28235 WRITEUP HIGH WRITEUP
Contao 4.9.0-4.13.39 - Session Cookie Disclosure via Crawler External URL Requests
Contao is an open source content management system. Starting in version 4.9.0 and prior to versions 4.13.40 and 5.3.4, when checking for broken links on protected pages, Contao sends the cookie header to external urls as well, the passed options for the http client are used for all requests. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable crawling protected pages.
CVSS 8.3
CVE-2024-30262 WRITEUP MEDIUM WRITEUP
Contao < 4.13.40 - Insufficient Session Expiration via Remember-Me Tokens
Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.
CVSS 5.9
CVE-2025-57758 WRITEUP MEDIUM WRITEUP
Contao 5.0.0-5.3.37 - Improper Access Control in Back-End Table Access Voter
Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't check if a user is allowed to access the corresponding module. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not relying solely on the voter and additionally to check USER_CAN_ACCESS_MODULE.
CVSS 4.3