verbb/comments

Packagist3 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting verbb/commentspage 1 of 1

CVE-2020-13868MEDIUMCVSS 6.5EG 6.5fixed in 1.5.5
2020-06-05
vulnerable: 0.3.6 ... 1.5.4 (52 versions)
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity.
CVE-2020-13869MEDIUMCVSS 5.4EG 5.4fixed in 1.5.5
2020-06-05
vulnerable: 0.3.6 ... 1.5.4 (52 versions)
An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS. There is stored XSS via a guest name.
CVE-2020-13870MEDIUMCVSS 5.4EG 5.4fixed in 1.5.5
2020-06-05
vulnerable: 0.3.6 ... 1.5.4 (52 versions)
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name.

Check whether verbb/comments is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for verbb/comments CVEs against the assets you own.

Book a Demo →