Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Contao core bundle vulnerable to cross site scripting in the file manager
Vulnerability Description
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files (back end and front end), which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, remove upload fields from frontend forms and disable uploads for untrusted back end users.
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Vulnerability Title
Contao 安全漏洞
Vulnerability Description
Contao是一套采用PHP开发的开源内容管理系统（CMS）。该系统支持搜索引擎、权限管理和CSS框架等。 Contao 4.13.40版本之前的4.x版本和5.3.4版本之前的5.x版本存在安全漏洞，该漏洞源于用户可以在上传文件时在文件名中注入恶意代码，然后在后端的工具提示和弹出窗口中执行。
CVSS Information
N/A
Vulnerability Type
N/A