SQL Injection in Typo3 Extension "News System"

CVE-2026-8726

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Expl…

Vulnerability class: SQL Injection

EPSS: 0.001 (35.1th percentile) — read the EPSS interpretation.