5 matches found
CVE-2026-112240
The TYPO3 Fluid-Form by coding.ms (fluid_form) extension contains a broken access control vulnerability. The issue stems from a predictable token used in download links for files uploaded via forms, combined with insufficient verification of the file name in requests. This allows an unauthenticat...
CVE-2026-112240 Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was show...
CVE-2026-113442
The TYPO3 Fluid-Form by coding.ms extension (fluid_form ) is vulnerable to Cross-Site Scripting (XSS) due to a lack of input escaping. Specifically, values provided by visitors are inserted into the HTML summary email without proper sanitization. This allows an unauthenticated attacker to inject ...
CVE-2026-113442 Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...
