p PatchFirst

PatchFirst · Latest vulnerabilities

contao/comments-bundle vulnerabilities

Vulnerabilities published for contao/comments-bundle in the last 30 days: 1. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗
Filter vulnerabilities
Clear filters

Vulnerabilities: 2

  1. CVE-2026-107845

    Critical · CVSS 9.3EPSS 0.27%Fix available

    Contao: Cross-site scripting in the comments bundle

    Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12.

    contao/comments-bundle contao/comments-bundlePHP
    • Update to 5.3.50
    • Update to 5.7.12
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

  2. CVE-2024-28234

    Medium · CVSS 4.3EPSS 0.57%Fix available

    Contao has insufficient BBCode sanitizer

    Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.

    contao/comments-bundle contao/comments-bundlePHP
    • Update to 4.13.40
    • Update to 5.3.4
    Published Updated
    Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →