{"id":"CVE-2018-10125","details":"Contao before 4.5.7 has XSS in the system log.","aliases":["GHSA-pj4j-287j-f742"],"modified":"2026-08-07T11:31:26.394427397Z","published":"2020-03-16T15:15:11.770Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"3.0.0"},{"last_affected":"3.5.33"}],"source":"CPE_RANGE","vendor_product":"contao:contao"}]},"references":[{"type":"ADVISORY","url":"https://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/contao/contao","events":[{"introduced":"da8a867d8335c4ca55e5085dac11f1fecd12650e"},{"last_affected":"d49004763b89068db1b36c671a16d08286d362d0"},{"introduced":"b09b4d51d13d37b4bfcd2ef4314fc6a20184dc55"},{"last_affected":"07baece6e09c2e89677a2a1e475583ddcad8627c"},{"introduced":"84b2fe637d5ead531f117f26b48d1b9de8df4074"},{"last_affected":"afeedc98905a9dedd598f5a5814decc1ad1b008d"}],"database_specific":{"extracted_events":[{"introduced":"4.4.0"},{"last_affected":"4.4.16"},{"introduced":"4.5.0"},{"last_affected":"4.5.6"},{"introduced":"4.0.0-NA"},{"last_affected":"4.0.0-NA"},{"introduced":"4.1.0-NA"},{"last_affected":"4.1.0-NA"},{"introduced":"4.2.0-NA"},{"last_affected":"4.2.0-NA"},{"introduced":"4.3.0-NA"},{"last_affected":"4.3.0-NA"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:contao:contao:*:*:*:*:*:*:*:*","cpe:2.3:a:contao:contao:4.0.0:-:*:*:*:*:*:*","cpe:2.3:a:contao:contao:4.1.0:-:*:*:*:*:*:*","cpe:2.3:a:contao:contao:4.2.0:-:*:*:*:*:*:*","cpe:2.3:a:contao:contao:4.3.0:-:*:*:*:*:*:*"]}}],"versions":["4.0.0-NA","4.1.0-NA","4.2.0-NA","4.3.0-NA"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-10125.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}