{"id":"CVE-2019-16682","aliases":["EUVD-2022-4125","GHSA-hcpv-xh8q-f3vq"],"status":"published","title":"url_redirect for Typo3 SQLi Vulnerability","description":"The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection.","severity":{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00818,"percentile":0.57415,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2019-10-16T18:46:50Z","modified":"2026-06-17T02:22:34Z","fixes":[{"ecosystem":"Packagist","package":"sfroemken/url_redirect","fixed_in":["1.2.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"sfroemken/url_redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.2.1"},{"fixed":"1.2.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"sfroemken/url_redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.2"}]}],"versions":["1.0.0","1.0.1","1.1.0","1.1.1","1.1.3","1.2.0","1.2.1"]}],"products":[{"vendor":"url_redirect_project","product":"url_redirect"}],"references":[{"url":"https://extensions.typo3.org/extension/url_redirect/","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2019-015/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16682","tags":["advisory"]},{"url":"https://github.com/froemken/url_redirect/commit/91cc8da2cf122eff0ecca14e9919ece7fca0a053","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hcpv-xh8q-f3vq"},{"url":"https://extensions.typo3.org/extension/url_redirect","tags":["web"]},{"url":"https://github.com/froemken/url_redirect","tags":["package"]},{"url":"https://typo3.org/security/advisory/typo3-ext-sa-2019-015","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-16682","description":"The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection.","status":"published","published":"2019-10-16T18:46:50Z","modified":"2024-08-05T01:17:41.094Z","updated_at":"2026-11-02T14:32:23.485011Z"}],"euvd":[{"id":"EUVD-2022-4125","description":"The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection.","status":"published","published":"2019-10-16T18:46:50Z","modified":"2024-08-05T01:17:41Z","updated_at":"2026-11-03T02:40:32.32735Z"}],"ghsa":[{"id":"GHSA-hcpv-xh8q-f3vq","title":"url_redirect for Typo3 SQLi Vulnerability","description":"The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection.","status":"published","published":"2022-05-24T16:58:55Z","modified":"2023-09-26T16:42:04Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:37:06.234371Z"}],"nvd":[{"id":"CVE-2019-16682","description":"The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection.","status":"published","published":"2019-10-16T19:15:15.753Z","modified":"2026-06-17T02:22:34.51Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:05:31.860711Z"}],"osv":[{"id":"GHSA-hcpv-xh8q-f3vq","title":"url_redirect for Typo3 SQLi Vulnerability","description":"The url_redirect (aka URL redirect) extension through 1.2.1 for TYPO3 fails to properly sanitize user input and is susceptible to SQL Injection.","status":"published","published":"2022-05-24T16:58:55Z","modified":"2024-02-22T05:32:05.252733Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T15:46:48.920784Z"}]}}