Description

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.

Remediation

References

CVE-2020-25768

Related Vulnerabilities

Plone CMS Server-Side Request Forgery (SSRF) Vulnerability (CVE-2021-33926)

Oracle JRE CVE-2013-0449 Vulnerability (CVE-2013-0449)

WordPress Plugin MainWP Child-Securely connects sites to the MainWP WordPress Manager Dashboard Cross-Site Scripting (2.0.12)

WordPress Plugin AccessPress Anonymous Post Pro Arbitrary File Upload (3.1.9)

WordPress Plugin Subscriptions & Memberships for PayPal Unspecified Vulnerability (1.1.5)

Severity

Medium

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2020-25768