CVE-2017-7581

9.8 criticalEPSS 48%

Critical (9.8) in news system project news system. EPSS 48% chance of exploitation in the next 30 days.

SQL injection vulnerability in NewsController.php in the News module 5.3.2 and earlier for TYPO3 allows unauthenticated users to execute arbitrary SQL commands via vectors involving overwriteDemand for order and OrderByAllowed.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 48% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2017-04-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

news_system_project:news_system

References

https://www.ambionics.io/blog/typo3-news-module-sqli
https://www.ambionics.io/blog/typo3-news-module-sqli

Check your stack JSON