CVE-2026-113442Medium· 5.3▾ SunlitValues entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
codingms/fluid-form >= 6.0.0 < 6.0.6codingms/fluid-form < 5.0.10Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-112240Medium· 6.3Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
CVE-2026-47344LowTYPO3 HTML Sanitizer allows Cross-site Scripting
CVE-2026-47348MediumTYPO3 CMS has Cross-Site Scripting in Indexed Search
CVE-2026-47345MediumTYPO3 HTML Sanitizer allows Cross-site Scripting
CVE-2026-112069Medium· 6.3Broken Access Control in extension "FAL Protect" (fal_protect)
CVE-2026-112070Medium· 5.3Broken Access Control in extension "Analytics" (analytics)