Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, it is possible to inject insert tags in frontend forms if the output is structured in a very specific way. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, do not output user data from frontend forms next to each other, always separate them by at least one character.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 Sulu CMS, Authorization Bypass, #CVE-2024-28191 (High) -DC-Sep2026-2105 https://dailycve.com/sulu-cms-authorization-bypass-cve-2024-28191-high-dc-sep2026-2105/
Post summary
The post announces a high‑severity authorization bypass vulnerability (CVE-2024-28191) in Sulu CMS, without mentioning PoC, exploit tools, active exploitation, patches, or false positives.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | contao | contao | - | - | - |