CVE-2021-31777
SQL Injection in t3/dce
The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
- Record
CVE-2021-31777- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-89
- Updated
- 2026-11-02
CVE List No score
The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
- Record
CVE-2021-31777- Updated
- 2026-11-02
EUVDEUVD-2021-1272
The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
- Record
EUVD-2021-1272- CVSS
- 0.0 None
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5v5h-4w2g-gxxc
SQL Injection in t3/dce
The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
- Record
GHSA-5v5h-4w2g-gxxc- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
OSVGHSA-5v5h-4w2g-gxxc
SQL Injection in t3/dce
The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.
- Record
GHSA-5v5h-4w2g-gxxc- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-31777 is a medium vulnerability (CVSS 4.9) in Dynamic Content Elements Project Content Elements, published April 28, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in t3/dce 2.6.2.
References
excellium-services.com/cert-xlm-advisory
typo3.org/security/advisory/typo3-ext-sa-2021-005
packetstormsecurity.com/files/162429/TYPO3-6.2.1-SQL-Injection.html
cds.thalesgroup.com/en/tcs-cert/CVE-2021-31777
nvd.nist.gov/vuln/detail/CVE-2021-31777
bitbucket.org/ArminVieweg/dce/commits/998a2392f69f2153797c5ace6e8914ca309e70c7
packagist.org/packages/t3/dce
github.com/advisories/GHSA-5v5h-4w2g-gxxc