p PatchFirst

CVE-2026-8726

CVE-2026-8726 · SQL Injection in extension "News system" (news)

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.

CVSS 8.2 · High · EPSS 0.4% · Public exploit · Fix available

Published
Updated

Stack: php

Affected products and versions

  • extension "news system"

    Versions
    • ≥ 14.0.0, < 14.0.3: Affected (semver)
    • ≥ 13.0.0, < 13.0.2: Affected (semver)
    • ≥ 12.0.0, < 12.3.2: Affected (semver)
    • ≥ 11.0.0, < 11.4.4: Affected (semver)
    • ≥ 0, < 10.0.4: Affected (semver)

    Update to 10.0.4; Update to 11.4.4; Update to 12.3.2; Update to 13.0.2; Update to 14.0.3

  • georgringer/news Packagist

    Versions
    • 12.0.0
    • 12.1.0
    • 12.2.0
    • 12.3.0
    • 12.3.1
    Affected ranges
    • ECOSYSTEM: ≥ 12.0.0, < 12.3.2

    Update to 12.3.2

  • georgringer/news Packagist

    Versions
    • 13.0.0
    • 13.0.1
    Affected ranges
    • ECOSYSTEM: ≥ 13.0.0, < 13.0.2

    Update to 13.0.2

  • georgringer/news Packagist

    Versions
    • 14.0.0
    • 14.0.1
    • 14.0.2
    Affected ranges
    • ECOSYSTEM: ≥ 14.0.0, < 14.0.3

    Update to 14.0.3

  • georgringer/news Packagist

    Versions
    • 10.0.0
    • 10.0.1
    • 10.0.2
    • 10.0.3
    • 3.1.0
    • 3.2.0
    • 3.2.1
    • 3.2.3
    • 3.2.4
    • 3.2.5
    • 3.2.6
    • 3.2.7
    • 3.2.9
    • 4.0.0
    • 4.1.0
    • 4.2.0
    • 4.2.1
    • 4.3.0
    • 4.3.1
    • 4.3.2
    • 5.0.0
    • 5.1.0
    • 5.2.0
    • 5.3.0
    • 5.3.1
    • 5.3.2
    • 5.3.3
    • 6.0.0
    • 6.1.0
    • 6.1.1
    • 6.2.0
    • 6.2.1
    • 6.3.0
    • 7.0.0
    • 7.0.1
    • 7.0.2
    • 7.0.3
    • 7.0.4
    • 7.0.5
    • 7.0.6
    • 7.0.7
    • 7.0.8
    • 7.1.0
    • 7.2.0
    • 7.2.1
    • 7.2.2
    • 7.2.3
    • 7.3.0
    • 7.3.1
    • 8.0.0
    • 8.1.0
    • 8.1.1
    • 8.2.0
    • 8.3.0
    • 8.4.0
    • 8.4.1
    • 8.5.0
    • 8.5.1
    • 8.5.2
    • 8.6.0
    • 9.0.0
    • 9.1.0
    • 9.1.1
    • 9.2.0
    • 9.3.0
    • 9.3.1
    • 9.4.0
    • 9.4.1
    Affected ranges
    • ECOSYSTEM: < 10.0.4

    Update to 10.0.4

  • georgringer/news Packagist

    Versions
    • 11.0.0
    • 11.1.0
    • 11.1.1
    • 11.1.2
    • 11.2.0
    • 11.3.0
    • 11.4.0
    • 11.4.1
    • 11.4.2
    • 11.4.3
    Affected ranges
    • ECOSYSTEM: ≥ 11.0.0, < 11.4.4

    Update to 11.4.4

Original sources

Check your server →