GitHub Advisoryadvisory · Packagist

GHSA-rrh3-cgmx-w62f Additional TCA Allows Cross-Site Scripting (XSS)

MEDIUM Published 2025-03-19 Modified 2025-03-19 Official page ↗
Aliases
CVE-2025-30083
Ecosystem
Packagist
Packages
codingms/additional-tca
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L/E:F/RL:O/RC:C
Weaknesses
CWE-79
Reviewed
2025-03-19

Affected packages

• Packagist codingms/additional-tca: >= 1.16.0, < 1.16.9 → fixed in 1.16.9 • Packagist codingms/additional-tca: >= 1.7.0, < 1.15.17 → fixed in 1.15.17

Description

A cross-site scripting (XSS) vulnerability has been discovered in the Additional TCA extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 1.15.17 and 1.16.9 are available for download.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References