CVE-2025-10316: Cross-Site Scripting Vulnerability in lavitto/typo3-form-to-database Package
Summary
CVE-2025-10316: TYPO3 "Form to Database" extension susceptible to Cross-site Scripting. Affects lavitto/typo3-form-to-database across 4 version ranges.
< 2.2.5
>= 3.0.0, < 3.2.2
>= 4.0.0, < 4.2.3
>= 5.0.0, < 5.0.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'lavitto/typo3-form-to-database' package is a TYPO3 extension designed to facilitate the storage of form submissions directly into a database. It provides users with the ability to manage form data efficiently, making it a valuable tool for TYPO3 developers. However, this package has been found to be vulnerable to Cross-Site Scripting (XSS), which can potentially allow attackers to inject malicious scripts into web pages viewed by other users.
Vulnerability Detail
The vulnerability arises from improper handling of user input, which allows for the injection of malicious scripts into the application. This can lead to unauthorized access to sensitive user data, session hijacking, or defacement of the website. The affected versions include all versions prior to 2.2.5, versions from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, and from 5.0.0 before 5.0.2. The severity of this vulnerability is classified as low, but it can still have significant implications if exploited.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.2.52.2.5composer require lavitto/typo3-form-to-database:2.2.5 -
>= 3.0.0, < 3.2.23.2.2composer require lavitto/typo3-form-to-database:3.2.2 -
>= 4.0.0, < 4.2.34.2.3composer require lavitto/typo3-form-to-database:4.2.3 -
>= 5.0.0, < 5.0.25.0.2composer require lavitto/typo3-form-to-database:5.0.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate updating is not feasible, consider sanitizing user inputs and escaping output to mitigate the risk of XSS attacks. Implementing Content Security Policy (CSP) headers can also help reduce the impact of potential XSS vulnerabilities.
Conclusion
The 'lavitto/typo3-form-to-database' package has a critical vulnerability that can lead to Cross-Site Scripting attacks. It is crucial to update to the latest patched versions to ensure the security of your application. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for lavitto/typo3-form-to-database →
FAQ
XSS is a security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users, potentially compromising user data and session integrity.
The affected versions include all versions before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, and from 5.0.0 before 5.0.2.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check your application without needing to sign up.
If you cannot update immediately, sanitize user inputs and escape outputs to reduce the risk of XSS. Implementing CSP headers can also help mitigate the impact.
Vulert is a tool that monitors open-source vulnerabilities in your software using the composer.lock file. It provides real-time alerts and insights into potential security issues.
