Cross-Site Scripting Vulnerability in Form to Database by TYPO3
CVE-2025-10316

2.3LOW

Key Information:

Vendor

Typo3

Status
Extension "form To Database" (form To Database)
Vendor
CVE Published:
16 September 2025

What is CVE-2025-10316?

The 'Form to Database' extension in TYPO3 is vulnerable to Cross-Site Scripting (XSS) attacks, exposing users to potential security threats. This vulnerability occurs in specific versions, allowing malicious scripts to be executed in the context of the user's browser. If exploited, attackers could manipulate website content or hijack user sessions. Users are urged to update their extensions to the latest versions to mitigate this security risk.

Affected Version(s)

Extension "Form to Database" (form_to_database) 0 < 2.2.5

Extension "Form to Database" (form_to_database) 3.0.0 < 3.2.2

Extension "Form to Database" (form_to_database) 4.0.0 < 4.2.3

References

https://typo3.org/security/advisory/typo3-ext-sa-2025-012

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sascha Egerer
JSON
.