Skip to content
OpenAdvisories

Vendor

contao

35 known vulnerabilities.

Products

contao 35
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-107845

    Contao: Cross-site scripting in the comments bundle

    Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca…

    contao contao contao/comments-bundle Packagist