CVE ID :CVE-2026-107845 Published : Oct. 9, 2026, 8:17 p.m. | 1 hour, 12 minutes ago Description :Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-107845 - Contao: Cross-site scripting in the comments bundle

VERWANDTEARTIKEL

CVE-2026-108264 - Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

CVE-2026-62376 - Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

CVE-2026-108263 - Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

CVE-2026-57458 - Vikunja: Scoped API token can mint unrestricted OAuth session credentials

CVE-2026-108261 - TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

CVE-2026-108259 - Tina: Code injection via unescaped Git branch name in generated client source