Skip to content
CVE PROGRAM SOURCE RECORD5.3 Medium

CVE-2026-113442

Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TYPO3

Description

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"

Default version status: unaffected

  • 6.0.0 to < 6.0.6affected
  • 0 to < 5.0.10affected

References