CVE-2026-8726
HighSummary
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the 'Date Menu of news articles' plugin.
Risk Assessment
An attacker may gain access to sensitive data in the database, potentially leading to serious security breaches and data loss.
Recommendation
It is recommended to update the 'Date Menu of news articles' plugin and enable the disableOverrideDemand option in TypoScript/Plugin settings to mitigate the risk of attack.
Original NVD description (English source)
The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the "Date Menu of news articles" plugin. Exploitation requires the "Date Menu of news articles" plugin to be in use and the TypoScript/Plugin setting disableOverrideDemand not to be enabled.