← CVE Intelligence

CVE-2026-8726

SQL Injection in extension "News system" (news) PUBLISHED

Description (CNA)

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

Affected (CNA)

Vendor / productVersions
TYPO3 / Extension "News system"affected 14.0.0 before 14.0.3; affected 13.0.0 before 13.0.2; affected 12.0.0 before 12.3.2; affected 11.0.0 before 11.4.4; affected 0 before 10.0.4

CWE

CWE-89

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.