Security Advisory

CVE-2026-8726

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-05-19 09:22:09

Last updated 2026-05-19 13:23:36

Assigner TYPO3

State PUBLISHED

Description

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

← Browse all CVEs View on cve.org ↗