Security Advisory

CVE-2026-8726

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-19 09:22:09

Last updated 2026-06-02 17:34:48

Assigner TYPO3

CVSS score 8.2

State PUBLISHED

Description

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

← Browse all CVEs View on cve.org ↗