En bref
- CVE-2026-8726 est une vulnérabilité ÉLEVÉE (CVSS 8.2) touchant georgringer/news.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.44%, plus élevée que 38.4% des vulnérabilités.
- Correctif : mettre à jour vers 11.4.4, 12.3.2, 13.0.2, 14.0.3 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| georgringer/news Packagist | ≥ 11.0.0, < 11.4.4≥ 12.0.0, < 12.3.2≥ 13.0.0, < 13.0.2≥ 14.0.0, < 14.0.3< 10.0.4
| 11.4.412.3.213.0.214.0.310.0.4
|
Description
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
NVD description
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free