SQL Injection in typo3 extension "LUX - TYPO3 Marketing Automation"

CRÍTICO 9.8CVE-2022-35628 · GHSA-rpxg-hg79-h8q9 · Published 12/07/2022 · updated 17/06/2026

En resumen

CVE-2022-35628 es una vulnerabilidad CRÍTICO (CVSS 9.8) que afecta a in2code/lux, living user experience (in2code).
Probabilidad de explotación en los próximos 30 días (EPSS): 26.8%, mayor que el 98.0% de las vulnerabilidades.
Solución: actualizar a 24.0.2, 17.6.1 o posterior.

Package	Affected versions	Patched versions
in2code/lux Packagist	`≥ 18.0.0, < 24.0.2< 17.6.1`	`24.0.217.6.1`
living user experience in2code	`≥ 18.0.0, < 24.0.2< 17.6.1`	`24.0.217.6.1`

A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.

NVD description

A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.