CVE-2026-112238High· 8.7▾ TwilightThe file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore le…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field.
ameos/ameos_filemanager < 3.1.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112064High· 7.1SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)
CVE-2026-49741HighTYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
CVE-2026-112069Medium· 6.3Broken Access Control in extension "FAL Protect" (fal_protect)
CVE-2026-112070Medium· 5.3Broken Access Control in extension "Analytics" (analytics)
CVE-2026-113468Medium· 6.9Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
CVE-2026-113459High· 7.1Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)