CVE-2025-10316
Cross-Site Scripting in extension "Form to Database" (form_to_database)
The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Cross-Site Scripting in extension "Form to Database" (form_to_database)
The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.
- Record
CVE-2025-10316- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2025-29543
The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.
- Record
EUVD-2025-29543- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-54pg-2x9h-cmx8
TYPO3 "Form to Database" extension susceptible to Cross-site Scripting
The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.
- Record
GHSA-54pg-2x9h-cmx8- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.
- Record
CVE-2025-10316- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Cross-Site Scripting in extension "Form to Database" (form_to_database)
The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.
- Record
CVE-2025-10316- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-54pg-2x9h-cmx8
TYPO3 "Form to Database" extension susceptible to Cross-site Scripting
The extension "Form to Database" is susceptible to Cross-Site Scripting. This issue affects the following versions: before 2.2.5, from 3.0.0 before 3.2.2, from 4.0.0 before 4.2.3, from 5.0.0 before 5.0.2.
- Record
GHSA-54pg-2x9h-cmx8- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
lavitto/typo3-form-to-databasePackagist | before 2.2.5 | 2.2.5 |
lavitto/typo3-form-to-databasePackagist | 3.0.0 up to 3.2.2 | 3.2.2 |
lavitto/typo3-form-to-databasePackagist | 4.0.0 up to 4.2.3 | 4.2.3 |
lavitto/typo3-form-to-databasePackagist | 5.0.0 up to 5.0.2 | 5.0.2 |
lavitto/typo3-form-to-databasePackagist | before 2.2.5, plus listed versions 1.0.01.0.11.0.21.0.31.0.4 Show 13 moreShow less1.0.52.0.02.0.12.0.22.0.32.0.42.1.12.1.22.2.02.2.12.2.22.2.32.2.4 | 2.2.5 |
lavitto/typo3-form-to-databasePackagist | 3.0.0 up to 3.2.2, plus listed versions 3.0.13.1.03.2.03.2.1 | 3.2.2 |
lavitto/typo3-form-to-databasePackagist | 4.0.0 up to 4.2.3, plus listed versions 4.1.04.2.04.2.14.2.2 | 4.2.3 |
lavitto/typo3-form-to-databasePackagist | 5.0.0 up to 5.0.2, plus listed versions 5.0.1 | 5.0.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-10316 is a low vulnerability (CVSS 2.3) in Typo3 Extension "form To Database" (form To Database), published September 16, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 27th percentile. Fixed in lavitto/typo3-form-to-database 2.2.5.
References
typo3.org/security/advisory/typo3-ext-sa-2025-012
nvd.nist.gov/vuln/detail/CVE-2025-10316
gitlab.com/lavitto/typo3-form-to-database/-/commit/a3ab9bf9c04061d1841fff96a08c4dbf48aaaf37
github.com/advisories/GHSA-54pg-2x9h-cmx8
packagist.org