https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-26T23:16:00.355534+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-4476 EUVD-2026-4476 2026-10-26T23:16:00.358104+00:00 EUVD-2026-4476 https://cve.radiocsirt.org/vuln/fkie_cve-2024-28191 fkie_cve-2024-28191 2026-10-26T23:16:00.358142+00:00

Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.

 https://cve.radiocsirt.org/vuln/ghsa-747v-52c4-8vj8 GHSA-747v-52c4-8vj8 — Contao: Unencoded insert tags in the frontend 2026-10-26T23:16:00.358173+00:00

Affected: Packagist: contao/core-bundle

### Impact

It is possible to inject insert tags via the form generator if the submitted form data is output on the page in a specific way.

### Patches

Update to Contao 4.13.40 or 5.3.4.

### Workarounds

Do not output the submitted form data on the website.

### References

https://contao.org/en/security-advisories/insert-tag-injection-via-the-form-generator

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

 https://cve.radiocsirt.org/vuln/gsd-2024-28191 gsd-2024-28191 2026-10-26T23:16:00.358205+00:00 gsd-2024-28191