CVE-2026-113442: medium-severity vulnerability in TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"
Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.5%
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Affected products
TYPO3 · Extension "TYPO3 Fluid-Form by coding.ms"Related CVEs — TYPO3 Extension "TYPO3 Fluid-Form by coding.ms"
In the same product, most dangerous first.