CVE-2026-113442
Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 20, 2026
- Updated
- Oct 20, 2026
- Reserved
- Oct 20, 2026
Description
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | TYPO3 |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Extension "TYPO3 Fluid-Form by coding.ms"TYPO3 |
|
References
- https://typo3.org/security/advisory/typo3-ext-sa-2026-033vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.