En resumen
- CVE-2026-8726 es una vulnerabilidad ALTO (CVSS 8.2) que afecta a georgringer/news.
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.44%, mayor que el 38.4% de las vulnerabilidades.
- Solución: actualizar a 11.4.4, 12.3.2, 13.0.2, 14.0.3 o posterior.
| Package | Affected versions | Patched versions |
|---|
| georgringer/news Packagist | ≥ 11.0.0, < 11.4.4≥ 12.0.0, < 12.3.2≥ 13.0.0, < 13.0.2≥ 14.0.0, < 14.0.3< 10.0.4
| 11.4.412.3.213.0.214.0.310.0.4
|
Description
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
NVD description
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
Más vulnerabilidades de georgringer/news
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free