CVE-2026-8827 — SQL Injection in extension "Address List" (tt_address)
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere with…
Published: 2026-05-19 · CVSS: 8.2 · CVSS 4.0
The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation. However, custom extensions that call this method with untrusted input would expose the site to SQL injection.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7