CVE-2026-112240

The TYPO3 Fluid-Form by coding.ms (fluid_form) extension contains a broken access control vulnerability. The issue stems from a predictable token used in download links for files uploaded via forms, combined with insufficient verification of the file name in requests. This allows an unauthenticat...

CVE-2026-112240 Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was show...

CVE-2026-112240 Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was show...

CVE-2026-113442 Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

CVE-2026-113442

The TYPO3 Fluid-Form by coding.ms extension (fluid_form ) is vulnerable to Cross-Site Scripting (XSS) due to a lack of input escaping. Specifically, values provided by visitors are inserted into the HTML summary email without proper sanitization. This allows an unauthenticated attacker to inject ...

CVE-2026-113442 Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

TYPO3-EXT-SA-2026-033: Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-033...

TYPO3-EXT-SA-2026-033: Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-033...

TYPO3 Fluid-Form: Cross-site scripting vulnerability due to coding.ms

TYPO3 Fluid-Form: Versions from 6.0.0 to 6.0.6 and 5.0.10 and earlier have a cross-site scripting vulnerability. This vulnerability arises due to values entered by visitors being placed in HTML digest emails without being escaped properly, allowing unauthenticated attackers to inject HTML into...

TYPO3 Fluid-Form: Encryption issue vulnerability due to coding.ms

TYPO3 Fluid-Form: Versions from 6.0.0 to 6.0.6 and before, as well as 5.0.10, have security vulnerabilities. These vulnerabilities stem from the use of a predictable token in the download link for uploading files via forms. Additionally, the filename in the request does not undergo anti-guessing...

EUVD-2020-1457

Malware in sbrugna...

EUVD-2020-1418

Malware in sbrugna...

CVE-2020-15241

TYPO3 Fluid Engine package typo3fluid/fluid before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like showFullName ? fullName : defaultValue. Updated versions of this package are...

CVE-2020-26216

TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with...

BIT-TYPO3-2020-15241

TYPO3 Fluid Engine package typo3fluid/fluid before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the ternary conditional operator in templates like showFullName ? fullName : defaultValue. Updated versions of this package are...

PT-2020-16356 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 9.5.23 TYPO3 versions prior to 10.4.10 Description: The system extension Fluid of the TYPO3 core is vulnerable to cross-site scripting when passing user-controlled data as an argument to Fluid view helpers. This issue...

CVE-2020-26216

TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with...

CVE-2020-26216

TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with...

Cross site scripting

TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with...

CVE-2020-26216 Cross-Site Scripting in TYPO3 Fluid

TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been detected in Fluid: 1. TagBasedViewHelper allowed XSS through maliciously crafted additionalAttributes arrays by creating keys with...