CVE-2026-8827

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.

• CWE-89

• https://typo3.org/security/advisory/typo3-ext-sa-2026-012

Published

May 19, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8809The Advanced Custom Fields: Extended plugin for WordPress is…9.8
• CVE-2026-8811SEPPmail versions before 15.0.5 allow improper handling of a…7.1
• CVE-2026-8813This affects versions of the package exifreader before 4.39.…7.7
• CVE-2026-8814Versions of the package exifreader before 4.39.0 are vulnera…5.5
• CVE-2026-8823Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fa…3.8
• CVE-2026-8825The Elementor Website Builder WordPress plugin before 4.1.4…4.9
• CVE-2026-8828A lack of authorization validation in version 1.0.0 or later…8.8
• CVE-2026-8829HTML::Entities versions before 3.84 for Perl read freed heap…7.5
• CVE-2026-8830A flaw was found in Keycloak. An authenticated user can bypa…4.3
• CVE-2026-8832The WPCode - Insert Headers and Footers + Custom Code Snippe…8.8
• CVE-2026-8833Improper neutralization of HTML-encoded characters in the UR…5.4
• CVE-2026-8834IBM HTTP Server 8.5, and 9.0 contains a buffer overflow vuln…8