Skip to content
OpenAdvisories

Package · Packagist

contao/comments-bundle

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-107845

    Contao: Cross-site scripting in the comments bundle

    Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca…

    contao contao contao/comments-bundle Packagist