What is GHSA-v3mr-gp7j-pw5w?

GHSA-v3mr-gp7j-pw5w is a security advisory published by GitHub Security Advisories with Critical severity. Possible SQL injection in tablelookupwizard Contao Extension

Why does GHSA-v3mr-gp7j-pw5w have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-v3mr-gp7j-pw5w?

GHSA-v3mr-gp7j-pw5w has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-v3mr-gp7j-pw5w?

GHSA-v3mr-gp7j-pw5w affects 1 product, including: composer/terminal42/contao-tablelookupwizard:\u003c 3.3.5.

GHSA-v3mr-gp7j-pw5wCriticalCVSS 9.8Disclosed before NVD

Possible SQL injection in tablelookupwizard Contao Extension

Vendor

GitHub Security Advisories

Published

February 10, 2022

Last Modified

January 23, 2026

📋 Description

Impact

The currently selected widget values were not correctly sanitized before passing it to the database, leading to an SQL injection possibility.

Patches

The issue has been patched in tablelookupwizard version 3.3.5 and version 4.0.0.

For more information

If you have any questions or comments about this advisory:

Open an issue in https://github.com/terminal42/contao-tablelookupwizard
Email us at [email protected]

🎯 Affected products1

composer/terminal42/contao-tablelookupwizard:< 3.3.5

🔗 References (4)

https://github.com/terminal42/contao-tablelookupwizard/security/advisories/GHSA-v3mr-gp7j-pw5w
https://github.com/terminal42/contao-tablelookupwizard/commit/a5e723a28f110b7df8ffc4175cef9b061d3cc717
https://github.com/FriendsOfPHP/security-advisories/blob/master/terminal42/contao-tablelookupwizard/2022-02-04-1.yaml
https://github.com/advisories/GHSA-v3mr-gp7j-pw5w