Description Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension. Remediation References CVE-2018-5478 Related Vulnerabilities WordPress Plugin Post Form-Registration Form-Profile Form for User Profiles and Content Forms for User Submissions PHAR Deserialization (2.7.7) Nginx Out-of-bounds Write Vulnerability (CVE-2022-41742) Oracle Database Server CVE-2010-2411 Vulnerability (CVE-2010-2411) Atlassian Jira Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2020-36231) WordPress Plugin Easy Forms for MailChimp Local File Inclusion (6.0.5.5) Severity Medium Classification CVE-2018-5478 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Tags Missing Update Known Vulnerabilities