GitHub Advisoryadvisory · Packagist

GHSA-54pg-2x9h-cmx8 TYPO3 "Form to Database" extension susceptible to Cross-site Scripting

LOW Published 2025-09-16 Modified 2025-09-16 Official page ↗
Aliases
CVE-2025-10316
Ecosystem
Packagist
Packages
lavitto/typo3-form-to-database
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Weaknesses
CWE-79
Reviewed
2025-09-16

Affected packages

• Packagist lavitto/typo3-form-to-database: < 2.2.5 → fixed in 2.2.5 • Packagist lavitto/typo3-form-to-database: >= 3.0.0, < 3.2.2 → fixed in 3.2.2 • Packagist lavitto/typo3-form-to-database: >= 4.0.0, < 4.2.3 → fixed in 4.2.3 • Packagist lavitto/typo3-form-to-database: >= 5.0.0, < 5.0.2 → fixed in 5.0.2

Description

The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.

Related

Alias · CVE (1)

  • CVE-2025-10316 The extension "Form to Database" is susceptible to Cross-Site Scripting. vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References