CVE-2021-35210

Name of the Vulnerable Software and Affected Versions: Contao versions 4.5.x through 4.9.x before 4.9.16 Contao versions 4.10.x through 4.11.x before 4.11.5

Description: The issue allows XSS, making it possible to inject code into the tl log table that will be executed in the browser when the system log is called in the back end.

Recommendations: Update to Contao 4.9.16 for versions 4.5.x through 4.9.x before 4.9.16. Update to Contao 4.11.5 for versions 4.10.x through 4.11.x before 4.11.5. As a temporary workaround, consider disabling the system log module in the back end for all users, especially admin users, until a patch is applied.