CVE-2020-25768

5.3 mediumEPSS 0.8%

Medium (5.3) in contao contao. EPSS 0.8% chance of exploitation in the next 30 days.

Contao before 4.4.52, 4.9.x before 4.9.6, and 4.10.x before 4.10.1 have Improper Input Validation. It is possible to inject insert tags in front end forms which will be replaced when the page is rendered.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS: 0.8% chance of exploitation in the next 30 days; higher than 57% of CVEs (scores of 2026-10-31)
CWEs: CWE-20, CWE-74
Published: 2020-10-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

contao:contao

References

https://community.contao.org/en/forumdisplay.php?4-Announcements
https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html
https://community.contao.org/en/forumdisplay.php?4-Announcements
https://contao.org/en/security-advisories/insert-tag-injection-in-forms.html

Check your stack JSON