Contao

An unauthenticated stored XSS vulnerability in the Contao comments-bundle allows remote attackers to execute arbitrary JavaScript in the context of administrative sessions, potentially leading to full system compromise.

Contao is affected by multiple vulnerabilities that may allow an unauthenticated or low-privileged attacker to bypass security controls, elevate privileges to administrator level, perform cross-site scripting (XSS) attacks, disclose sensitive information, and manipulate data.

An authenticated remote attacker can exploit a vulnerability in Contao to disclose sensitive information, gaining unauthorized access to data within the system.