In short
- CVE-2026-8726 is a HIGH (CVSS 8.2) vulnerability affecting georgringer/news.
- Chance of exploitation in the next 30 days (EPSS): 0.44%, higher than 38.4% of all vulnerabilities.
- Fix: update to 11.4.4, 12.3.2, 13.0.2, 14.0.3 or later.
| Package | Affected versions | Patched versions |
|---|
| georgringer/news Packagist | ≥ 11.0.0, < 11.4.4≥ 12.0.0, < 12.3.2≥ 13.0.0, < 13.0.2≥ 14.0.0, < 14.0.3< 10.0.4
| 11.4.412.3.213.0.214.0.310.0.4
|
Description
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
NVD description
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
More vulnerabilities in georgringer/news
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free