CVE-2011-0508

Cross-site scripting (XSS) vulnerability in system/modules/comments/Comments.php in Contao CMS 2.9.2, and possibly other versions before 2.9.3, allows remote attackers to inject arbitrary web script or HTML via the HTTP X_FORWARDED_FOR header, which is stored by system/libraries/Environment.php but not properly handled by a comments action to main.php.

• CWE-79

• http://dev.contao.org/issues/2751
• http://secunia.com/advisories/42899Vendor Advisory
• http://www.contao.org/changelog.htmlPatch
• http://www.contao.org/news/items/contao-2_9_3.htmlPatch, Vendor Advisory
• http://www.osvdb.org/70440
• http://www.securityfocus.com/archive/1/515691/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64679
• http://dev.contao.org/issues/2751
• http://secunia.com/advisories/42899Vendor Advisory
• http://www.contao.org/changelog.htmlPatch
• http://www.contao.org/news/items/contao-2_9_3.htmlPatch, Vendor Advisory
• http://www.osvdb.org/70440
• http://www.securityfocus.com/archive/1/515691/100/0/threaded
• https://exchange.xforce.ibmcloud.com/vulnerabilities/64679

Published

Jan 20, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-0502Music Animation Machine MIDI Player 2006aug19 Release 035 an…
• CVE-2011-0503Cross-site request forgery (CSRF) vulnerability in VaM Shop …
• CVE-2011-0504Multiple cross-site scripting (XSS) vulnerabilities in VaM S…
• CVE-2011-0505Directory traversal vulnerability in system/system.php in Zw…
• CVE-2011-0506Directory traversal vulnerability in modules/profile/user.ph…
• CVE-2011-0507FTPService.exe in Blackmoon FTP 3.1 Build 1735 and Build 173…
• CVE-2011-0509Cross-site scripting (XSS) vulnerability in Vaadin before 6.…
• CVE-2011-0510SQL injection vulnerability in cart.php in Advanced Webhost …
• CVE-2011-0511SQL injection vulnerability in the allCineVid component (com…
• CVE-2011-0512SQL injection vulnerability in team.php in the Teams Structu…
• CVE-2011-0513DCR.sys driver in SecurStar DriveCrypt 5.4, 5.3, and earlier…
• CVE-2011-0514The RDS service (rds.exe) in HP Data Protector Manager 6.11 …