CVE-2024-28234

Contao is an open source content management system. Starting in version 2.0.0 and prior to versions 4.13.40 and 5.3.4, it is possible to inject CSS styles via BBCode in comments. Installations are only affected if BBCode is enabled. Contao versions 4.13.40 and 5.3.4 have a patch for this issue. As a workaround, disable BBCode for comments.

• CWE-74

• https://contao.org/en/security-advisories/insufficient-bbcode-sanitizationVendor Advisory
• https://github.com/contao/contao/commit/55b995d8d35da0d36bc6a22c53fe6423ab0c4ae2Patch
• https://github.com/contao/contao/commit/6d42e667177c972ae7c219645593c262d7764ce2Patch
• https://github.com/contao/contao/security/advisories/GHSA-j55w-hjpj-825gVendor Advisory
• https://contao.org/en/security-advisories/insufficient-bbcode-sanitizationVendor Advisory
• https://github.com/contao/contao/commit/55b995d8d35da0d36bc6a22c53fe6423ab0c4ae2Patch
• https://github.com/contao/contao/commit/6d42e667177c972ae7c219645593c262d7764ce2Patch
• https://github.com/contao/contao/security/advisories/GHSA-j55w-hjpj-825gVendor Advisory

Published

Apr 9, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28229In JetBrains YouTrack before 2024.1.25893 user without appro…6.5
• CVE-2024-2823A vulnerability has been found in DedeCMS 5.7 and classified…4.3
• CVE-2024-28230In JetBrains YouTrack before 2024.1.25893 attaching/detachin…6.5
• CVE-2024-28231eprosima Fast DDS is a C++ implementation of the Data Distri…7.5
• CVE-2024-28232Go package IceWhaleTech/CasaOS-UserService provides user man…7.5
• CVE-2024-28233JupyterHub is an open source multi-user server for Jupyter n…6.1
• CVE-2024-28235Contao is an open source content management system. Starting…6.5
• CVE-2024-28236Vela is a Pipeline Automation (CI/CD) framework built on Lin…6.5
• CVE-2024-28237OctoPrint provides a web interface for controlling consumer …4.8
• CVE-2024-28238Directus is a real-time API and App dashboard for managing S…2.3
• CVE-2024-28239Directus is a real-time API and App dashboard for managing S…4.3
• CVE-2024-2824A vulnerability was found in Matthias-Wandel jhead 3.08 and …6.3