N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-10316

CVE-2025-10316: TYPO3 "Form to Database" extension susceptible to Cross-site Scripting

The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-10316

CVE-2025-10316:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
lavitto/typo3-form-to-database	composer	< 2.2.5	2.2.5
lavitto/typo3-form-to-database	composer	>= 3.0.0, < 3.2.2	3.2.2
lavitto/typo3-form-to-database	composer	>= 4.0.0, < 4.2.3	4.2.3
lavitto/typo3-form-to-database	composer	>= 5.0.0, < 5.0.2	5.0.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a Cross-Site Scripting (XSS) issue within the "Form to Database" (form_to_database) TYPO3 extension. The analysis of the provided patch and security advisory pinpoints the exact location of the vulnerability. The advisory TYPO3-EXT-SA-2025-012 states that the extension "fails to properly encode user input for output in HTML context in TYPO3 backend user interface". The commit a3ab9bf9c04061d1841fff96a08c4dbf48aaaf37 provides the concrete evidence. The diff shows a change in Classes/Utility/FormValueUtility.php, where the implode function is used on an array of values. The vulnerable code directly joins array elements into a string, which, if it contains malicious HTML, would be rendered in the backend, causing XSS. The fix involves wrapping the array values with htmlspecialchars before imploding them, thus neutralizing any HTML tags. By examining the file structure and the code, the vulnerable function was identified as getValues within the FormValueUtility class. This function would be on the execution path when the form data is processed and prepared for display, making it a key indicator of the vulnerability being triggered.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.