Extension Forms Export
Monthly
SQL injection in the TYPO3 'Forms Export' backend extension allows a low-privileged authenticated backend user to inject arbitrary SQL through a URL parameter, yielding high-impact access to the underlying database (confidentiality, integrity, and availability). Exploitation is constrained to users with at least read access to the Forms Export backend module, limiting the attack surface to the TYPO3 administrative backend. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential database impact.
SQL injection in the TYPO3 'Forms Export' backend extension allows a low-privileged authenticated backend user to inject arbitrary SQL through a URL parameter, yielding high-impact access to the underlying database (confidentiality, integrity, and availability). Exploitation is constrained to users with at least read access to the Forms Export backend module, limiting the attack surface to the TYPO3 administrative backend. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 4.0 score of 7.7 reflects the high potential database impact.