Search
Find a vulnerability
Search criteria
2 vulnerabilities found for filament-comments by parallax
CVE-2026-90943 (GCVE-0-2026-90943)
Vulnerability from nvd – Published: 2026-09-14 15:37 – Updated: 2026-09-14 20:07
VLAI
EPSS
VEX
Title
parallax filament-comments through 3.0.0 Stored XSS via Comment Body
Summary
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:21 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackindex.io/research/stored-xss-filament… | third-party-advisorytechnical-description |
| https://github.com/parallax/filament-comments/blo… | technical-description |
| https://github.com/parallax/filament-comments/blo… | technical-description |
| https://packagist.org/packages/parallax/filament-… | product |
| https://www.vulncheck.com/advisories/parallax-fil… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| parallax | filament-comments |
Affected:
0 , ≤ 3.0.0
(semver)
|
Date Public
2026-08-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90943",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:21:27.866482Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:07:01.726Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "parallax/filament-comments",
"packageURL": "pkg:composer/parallax/filament-comments",
"product": "filament-comments",
"vendor": "parallax",
"versions": [
{
"lessThanOrEqual": "3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua van der Poll"
}
],
"datePublic": "2026-08-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T15:37:31.329Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "HackIndex: Stored XSS in parallax/filament-comments through unescaped comment rendering",
"tags": [
"third-party-advisory",
"technical-description"
],
"url": "https://hackindex.io/research/stored-xss-filament-comments-unescaped-rendering"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/parallax/filament-comments/blob/3.0.0/resources/views/comments.blade.php"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/parallax/filament-comments/blob/3.0.0/src/Policies/FilamentCommentPolicy.php"
},
{
"tags": [
"product"
],
"url": "https://packagist.org/packages/parallax/filament-comments"
},
{
"name": "VulnCheck Advisory: parallax filament-comments through 3.0.0 Stored XSS via Comment Body",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/parallax-filament-comments-through-3.0.0-stored-xss-via-comment-body"
}
],
"title": "parallax filament-comments through 3.0.0 Stored XSS via Comment Body",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90943",
"datePublished": "2026-09-14T15:37:31.329Z",
"dateReserved": "2026-09-14T11:34:24.687Z",
"dateUpdated": "2026-09-14T20:07:01.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-90943 (GCVE-0-2026-90943)
Vulnerability from cvelistv5 – Published: 2026-09-14 15:37 – Updated: 2026-09-14 20:07
VLAI
EPSS
VEX
Title
parallax filament-comments through 3.0.0 Stored XSS via Comment Body
Summary
parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions.
Severity
8.7 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-14 19:21 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://hackindex.io/research/stored-xss-filament… | third-party-advisorytechnical-description |
| https://github.com/parallax/filament-comments/blo… | technical-description |
| https://github.com/parallax/filament-comments/blo… | technical-description |
| https://packagist.org/packages/parallax/filament-… | product |
| https://www.vulncheck.com/advisories/parallax-fil… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| parallax | filament-comments |
Affected:
0 , ≤ 3.0.0
(semver)
|
Date Public
2026-08-21 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-90943",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-14T19:21:27.866482Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T20:07:01.726Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://packagist.org",
"defaultStatus": "unaffected",
"packageName": "parallax/filament-comments",
"packageURL": "pkg:composer/parallax/filament-comments",
"product": "filament-comments",
"vendor": "parallax",
"versions": [
{
"lessThanOrEqual": "3.0.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Joshua van der Poll"
}
],
"datePublic": "2026-08-21T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those comments, including administrators, enabling session token theft and unauthorized actions."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-14T15:37:31.329Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "HackIndex: Stored XSS in parallax/filament-comments through unescaped comment rendering",
"tags": [
"third-party-advisory",
"technical-description"
],
"url": "https://hackindex.io/research/stored-xss-filament-comments-unescaped-rendering"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/parallax/filament-comments/blob/3.0.0/resources/views/comments.blade.php"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/parallax/filament-comments/blob/3.0.0/src/Policies/FilamentCommentPolicy.php"
},
{
"tags": [
"product"
],
"url": "https://packagist.org/packages/parallax/filament-comments"
},
{
"name": "VulnCheck Advisory: parallax filament-comments through 3.0.0 Stored XSS via Comment Body",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/parallax-filament-comments-through-3.0.0-stored-xss-via-comment-body"
}
],
"title": "parallax filament-comments through 3.0.0 Stored XSS via Comment Body",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-90943",
"datePublished": "2026-09-14T15:37:31.329Z",
"dateReserved": "2026-09-14T11:34:24.687Z",
"dateUpdated": "2026-09-14T20:07:01.726Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}