CVE-2021-31777: Dynamic Content Elements Project Dynamic Content Elements

Medium severity, CVSS 4.9. EPSS: 1.4% chance of exploitation in the next 30 days.

The dce (aka Dynamic Content Element) extension 2.2.0 through 2.6.x before 2.6.2, and 2.7.x before 2.7.1, for TYPO3 allows SQL Injection via a backend user account.

Affected products

• Dynamic Content Elements Project Dynamic Content Elements: from 2.2.0, before 2.6.2 (fixed in 2.6.2); from 2.7.0, before 2.7.1 (fixed in 2.7.1)

Published 2021-04-28. Last modified 2026-06-17.