CVE-2014-8874: The ke_questionnaire extension 2.5.2 and earlier for TYPO3 uses predictable names for the questionnaire ans...

Security readout for executives and security teams

This CVE concerns a TYPO3 questionnaire extension that used predictable names for answer forms. A remote party could request those forms directly and potentially view sensitive questionnaire responses. The public bundle does not provide CVSS, confirmed exploitation, or a named fixed version, so urgency depends on whether affected TYPO3 sites still use this extension. Exposure is likely limited to TYPO3 installations that deployed ke_questionnaire version 2.5.2 or earlier and stored answer forms in web-accessible locations. Organizations without TYPO3 or without this extension are not indicated as affected by the supplied sources. Prioritize if legacy TYPO3 questionnaire functionality remains internet-facing or collected sensitive responses. The issue is old and not KEV-listed, but stale extensions can leave historical data exposed. If no affected deployment exists, document non-exposure and close with evidence. Mitigation focus: Inventory TYPO3 sites for ke_questionnaire 2.5.2 or earlier.; Check TYPO3 extension and vendor advisory guidance for fixed versions or official mitigations.; Disable or remove the extension where it is no longer required..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.