TYPO3 Form to Database Extension Cross-Site Scripting Vulnerability

A cross-site scripting vulnerability has been identified in the TYPO3 extension "Form to Database". This issue affects versions prior to 2.2.5, versions 3.0.0 through 3.2.1, versions 4.0.0 through 4.2.2, and versions 5.0.0 through 5.0.1. The vulnerability arises because the extension does not properly encode user input for output in the HTML context of the TYPO3 backend user interface.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users are advised to update to version 2.2.5, 3.2.2, 4.2.3, or 5.0.2, available through the TYPO3 extension manager, Packagist, or directly from the TYPO3 extensions repository.