Description

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.

Remediation

References

CVE-2020-25768

Related Vulnerabilities

Sqlite Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-6592)

WordPress Plugin Redirect 404 to parent Cross-Site Scripting (1.3.0)

Oracle Database Server CVE-2015-4888 Vulnerability (CVE-2015-4888)

Joomla! Core Multiple Cross-Site Scripting Vulnerabilities (2.5.0 - 3.9.1)

WebLogic CVE-2020-2867 Vulnerability (CVE-2020-2867)

Severity

Medium

Classification

CVE-2020-25768 CWE-20 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Tags

Missing Update Known Vulnerabilities