Most recent entries from all

EUVD-2026-319420

fkie_cve-2026-46721

The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.

GHSA-v348-vr4q-fv9p — TYPO3 sf_register extension allows unauthorized assignment of frontend user groups

Affected: Packagist: evoweb/sf-register

The `create` and `edit` flows in the TYPO3 extension sf_register do not restrict which user properties may be submitted, and do not enforce access control on the frontend user group assignment. As a result, an attacker can assign an arbitrary frontend user group to a newly registered or edited account, gaining unauthorized access to content and functionality restricted to privileged frontend user groups.

WID-SEC-W-2026-1585 — TYPO3 Extensions: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in TYPO3 Extensions ausnutzen, um beliebigen Programmcode auszuführen, um einen SQL-Injection Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.