Description

Contao is an Open Source CMS. In versions starting from 5.0.0 and prior to 5.3.38 and 5.6.1, if a news feed contains protected news archives, their news items are not filtered and become publicly available in the RSS feed. This issue has been patched in versions 5.3.38 and 5.6.1. A workaround involves not adding protected news archives to the news feed page.

Remediation

References

CVE-2025-57757

Related Vulnerabilities

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-4599)

WordPress Plugin WP-Recall-Registration, Profile, Commerce & More Security Bypass (16.26.6)

MediaWiki Resource Management Errors Vulnerability (CVE-2015-8002)

MyBB Insertion of Sensitive Information into Log File Vulnerability (CVE-2015-8977)

Drupal Core 4.7.x Form Action Attribute Injection (4.7.0 - 4.7.3)

Severity

Medium

Classification

CVE-2025-57757 CWE-200 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities