Typo3 Extension "News System" vulnerabilities

1 vulnerability

Known vulnerabilities in Typo3 Extension "News System", newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

PrioritiseCVE-2026-8726typo3 · extension "news system"SQL Injection in extension "News system" (news)The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.CVSS8.2HighEPSS0.44%