{"id":"GHSA-wq4r-8342-jmc9","aliases":["CVE-2021-28381"],"title":"SQL injection in vhs (aka VHS: Fluid ViewHelpers)","description":"The vhs (aka VHS: Fluid ViewHelpers) extension before 5.1.1 for TYPO3 allows SQL injection via isLanguageViewHelper.","severity":"medium","score":5.4,"published":"2021-03-29T20:24:44.000Z","modified":"2023-11-08T04:05:30.047Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"fluidtypo3/vhs","ranges":[{"events":[{"introduced":"0"},{"fixed":"5.1.1"}],"type":"ECOSYSTEM"}],"versions":["1.8.3","1.8.4","2.0.0","2.0.2","2.1.1","2.1.2","2.1.3","2.1.4","2.2.0","2.3.0","2.3.1","2.3.2","2.3.3","2.4.0","3.0.0","3.0.1","3.1.0","4.0.0","4.1.0","4.2.0","4.3.0","4.3.1","4.3.2","4.3.3","4.4.0","5.0.0","5.0.1","5.1.0"],"fixed":["5.1.1"]}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2021-28381","https://typo3.org/security/advisory/typo3-ext-sa-2021-001"],"sources":[{"name":"OSV","id":"GHSA-wq4r-8342-jmc9","modified":"2023-11-08T04:05:30.047916Z","url":"https://osv.dev/vulnerability/GHSA-wq4r-8342-jmc9"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C","score":5.4}]}