CVE-2021-37626

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

Contao is an open source CMS that allows you to create websites and scalable web applications. In affected versions it is possible to load PHP files by entering insert tags in the Contao back end. Installations are only affected if they have untrusted back end users who have the rights to modify fields that are shown in the front end. Update to Contao 4.4.56, 4.9.18 or 4.11.7 to resolve. If you cannot update then disable the login for untrusted back end users.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Aug 11, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-376277.2Contao is an open source CMS that allows creation of websites and scalable web applications. In affected versions it is possible to gain priCVE-2021-376287.5Nextcloud Richdocuments is an open source collaborative office suite. In affected versions the File Drop features ("Upload Only" public linkCVE-2021-376295.3Nextcloud Richdocuments is an open source collaborative office suite. In affected versions there is a lack of rate limiting on the RichdocumCVE-2021-37634.3A flaw was found in the Red Hat AMQ Broker management console in version 7.8 where an existing user is able to access some limited informatiCVE-2021-376306.5Nextcloud Circles is an open source social network built for the nextcloud ecosystem. In affected versions the Nextcloud Circles applicationCVE-2021-376316.5Deck is an open source kanban style organization tool aimed at personal planning and project organization for teams integrated with NextclouCVE-2021-376328.1SuperMartijn642's Config Lib is a library used by a number of mods for the game Minecraft. The versions of SuperMartijn642's Config Lib betwCVE-2021-376336.1Discourse is an open source discussion platform. In versions prior to 2.7.8 rendering of d-popover tooltips can be susceptible to XSS attackCVE-2021-376346.1Leafkit is a templating language with Swift-inspired syntax. Versions prior to 1.3.0 are susceptible to Cross-site Scripting (XSS) attacks. CVE-2021-376357.1TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of sparse reduction operationCVE-2021-376365.5TensorFlow is an end-to-end open source platform for machine learning. In affected versions the implementation of `tf.raw_ops.SparseDenseCwiCVE-2021-376375.5TensorFlow is an end-to-end open source platform for machine learning. It is possible to trigger a null pointer dereference in TensorFlow by