Duplicate Advisory: Contao allows admin an account to upload SVG file containing malicious JavaScript

Mô tả

Tham khảo

• nvd.nist.gov/vuln/detail/CVE-2024-45965 · ADVISORY
• contao.org/en/security-advisories/cross-site-scripting-through-svg-uploads · WEB
• contao/contao · PACKAGE
• grimthereaperteam.medium.com/contao-5-4-1-malicious-file-upload-xss-in-svg-30edb8820ecb · WEB

Lỗ hổng khác của contao/contao

• CVE-2026-55825THẤP 3.1Contao is an Open Source CMS. In versions 5.7.0 through 5.7.6, an authenticated backend user who can access one job can request an attachmen…
• CVE-2026-57232THẤP 3.1Contao is an Open Source CMS. From 5.3.35 through 5.3.47 and from 5.7.0-RC1 through 5.7.8, the Feed Reader front-end module passes configure…
• CVE-2026-55824THẤP 2.6Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external…
• CVE-2025-57759TRUNG BÌNH 4.3Contao is an Open Source CMS. In versions starting from 5.3.0 and prior to 5.3.38 and 5.6.1, under certain conditions, back end users may be…
• CVE-2025-57758TRUNG BÌNH 4.3Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, the table access voter in the back end doesn't …