Cross site scripting in the system log
ImpactIt is possible to inject code into the `tl_log` table that will be executed in the browser when the system log is called in the back end.PatchesUpdate to Contao 4.9.16 or 4.11.5.WorkaroundsDisable the system log module in the back end for all users (especially admin users).Referenceshttps://contao.org/en/security-advisories/cross-site-scripting-in-the-system-log-2021For more informationIf you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).