Sascha Egerer

**Name of the Vulnerable Software and Affected Versions** Form to Database versions prior to 2.2.5 Form to Database versions 3.0.0 through 3.2.2 Form to Database versions 4.0.0 through 4.2.3 Form to Database versions 5.0.0 through 5.0.2 **Description** The extension "Form to Database" is susceptible to Cross-Site Scripting. **Recommendations** Update to a version prior to 2.2.5. Update to a version prior to 3.0.0 or after 3.2.2. Update to a version prior to 4.0.0 or after 4.2.3. Update to a version prior to 5.0.0 or after 5.0.2.

**Name of the Vulnerable Software and Affected Versions** Joomla! Core versions prior to 3.8.8 **Description** An issue was discovered where the web install application would autofill password fields after a form validation error or navigating to a previous install step, and display the plaintext password for the administrator account at the confirmation screen. **Recommendations** For versions prior to 3.8.8, update to version 3.8.8 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** TYPO3 versions 6.0.x through 6.0.7 TYPO3 versions 6.1.x through 6.1.3 **Description** The issue allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in the file extension when renaming a file. This is due to an incomplete fix for a previous issue. **Recommendations** For TYPO3 versions 6.0.x through 6.0.7, update to version 6.0.8 or later. For TYPO3 versions 6.1.x through 6.1.3, update to version 6.1.4 or later.