CVE-2025-10316 Details
Description
The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.
A cross-site scripting vulnerability has been identified in the TYPO3 extension "Form to Database". This issue affects versions prior to 2.2.5, versions 3.0.0 through 3.2.1, versions 4.0.0 through 4.2.2, and versions 5.0.0 through 5.0.1. The vulnerability arises because the extension does not properly encode user input for output in the HTML context of the TYPO3 backend user interface.
Users are advised to update to version 2.2.5, 3.2.2, 4.2.3, or 5.0.2, available through the TYPO3 extension manager, Packagist, or directly from the TYPO3 extensions repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2025CISA-ADP
Assessed Sep 16, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://typo3.org/security/advisory/typo3-ext-sa-2025-012 | TYPO3 | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | TYPO3 |
Affected Products
| Product | Versions |
|---|---|
| TYPO3 Form to Database | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | TYPO3 |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2025 | New CVE Received | TYPO3 |