SQL Injection in Typo3 Cms

CVE-2026-49741

Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler, bypassing the Form Framework's persistence validation and permission checks. Thi…

Vulnerability class: SQL Injection

EPSS: 0.002 (15.7th percentile) — read the EPSS interpretation.