Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-77137

SQL Injection in extension "Forms Export" (frp_form_answers)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
TYPO3

Description

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the "Forms Export" Backend module.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

TYPO3 Extension "Forms Export"

Default version status: unaffected

  • 7.0.0 to < 7.1.1affected
  • 6.0.0 to < 6.1.3affected
  • 0 to < 5.0.5affected

References