Vulnerability Database · Packagist · verbb/comments · Version
verbb/comments 1.0.6
1.0.6 is affected by 3 vulnerabilities.
The vulnerabilities that cover this exact version are listed below with the fixed version to move to.
Critical 0 High 0 Medium 3 Low 0 Unrated 0
-
Database updated 23/Oct/2026
Concerned about your application's security?
Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.
01 Vulnerabilities affecting this version
verbb/comments 1.0.6 vulnerabilities
3 vulnerabilities cover verbb/comments 1.0.6. Open the full list in the database.
| Vulnerability | Severity | Fixed version | Disclosed |
|---|---|---|---|
| CVE-2020-13868: Comments plugin Cross-Site Request Forgery (CSRF) in verbb/comments | 6.5 medium | 1.5.5 | 24 May 2022 |
| CVE-2020-13870: Comments plugin stored Cross-site Scripting (XSS) via an asset volume name | 5.4 medium | 1.5.5 | 24 May 2022 |
| CVE-2020-13869: Comments plugin stored Cross-site Scripting via a guest name | 5.4 medium | 1.5.5 | 24 May 2022 |
Looking for another version, or everything Vulert holds for verbb/comments?
Questions
About verbb/comments 1.0.6
Is verbb/comments 1.0.6 vulnerable?
Yes. 3 vulnerabilities in the Vulert database cover verbb/comments 1.0.6: 0 critical, 0 high, 3 medium and 0 low. Each entry above names the fixed version to move to.
How do I monitor verbb/comments for upcoming vulnerabilities?
Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the verbb/comments version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.