https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-23T23:22:38.935730+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-45794 EUVD-2026-45794 2026-10-23T23:22:38.938500+00:00 EUVD-2026-45794 https://cve.radiocsirt.org/vuln/fkie_cve-2020-25768 fkie_cve-2020-25768 2026-10-23T23:22:38.938533+00:00

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.

 https://cve.radiocsirt.org/vuln/ghsa-f7wm-x4gw-6m23 GHSA-f7wm-x4gw-6m23 — Contao Insert tag injection in forms 2026-10-23T23:22:38.938563+00:00

Affected: Packagist: contao/core-bundle, Packagist: contao/contao

### Impact

It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.

### Patches

Update to Contao 4.4.52, 4.9.6 or 4.10.1.

### Workarounds

Disable the front end login form and do not use form fields with array keys such as `fieldname[]`.

### References

https://contao.org/en/security-advisories/insert-tag-injection-in-forms

### For more information

If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).

 https://cve.radiocsirt.org/vuln/gsd-2020-25768 gsd-2020-25768 2026-10-23T23:22:38.938599+00:00 gsd-2020-25768