Composer contao/core has 12 known advisories in the phpwarden feed. Feed 2026.10.28.3, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2016-4567 | MediaElement Vulnerable to Reflected XSS | medium | 6.1 | >=3.0.0 and <3.5.15 | 3.5.15 |
| CVE-2017-10993 | Contao Core directory traversal vulnerability | high | 8.8 | >=3.0.0 and <3.5.28 | 3.5.28 |
| CVE-2015-0269 | Contao Core directory traversal vulnerability | medium | 4.3 | >=3.4.0 and <3.4.4 or >=2.0.0 and <3.2.19 or >=2.0.0 and <3.0.0 or >=3.0.0 and <3.4.4 | 3.4.4 |
| CVE-2017-16558 | SQL injection vulnerabililty in the back end search filter and the front end listing module | unknown | 0.0 | >=3.0.0 and <3.5.31 | 3.5.31 |
| CVE-2019-10641 | Contao Does Not Invalidate Existing Sessions When Password Changes | critical | 9.8 | >=3.0.0 and <3.5.39 | 3.5.39 |
| CVE-2012-4383 | Contao core SQL Injection Vulnerability | high | 8.8 | <2.11.4 | 2.11.4 |
| CVE-2018-10125 | Cross-site Scripting in Contao | medium | 6.1 | >=3.0.0 and <3.5.35 | 3.5.35 |
| CVE-2018-5478 | Contao Cross-site Scripting vulnerabililty | medium | 6.1 | >=3.0.0 and <3.5.32 | 3.5.32 |
| GHSA-wxxw-5gq6-j2g5 | contao/core Insufficient input validation allows for code injection and remote execution | critical | 9.0 | >=2.0.0 and <2.11.17 or >=3.0.0 and <3.2.9 | 2.11.17, 3.2.9 |
| 2014-02-13 | PHP object injection vulnerability allows for arbitrary code execution | unknown | 0.0 | >=2.0.0 and <2.11.16 or >=3.0.0 and <3.2.7 | 2.11.16, 3.2.7 |
| 2014-04-07 | Insufficient input validation allows for code injection and remote execution | unknown | 0.0 | >=2.0.0 and <2.11.17 or >=3.0.0 and <3.2.9 | 2.11.17, 3.2.9 |
| GHSA-wq43-8r5p-w3mc | contao/core PHP object injection vulnerability allows for arbitrary code execution | high | 0.0 | >=2.0.0 and <2.11.14 or >=3.0.0 and <3.2.5 | 2.11.14, 3.2.5 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked