Typesettercms

14 CVEs across 1 Typesettercms products. Browse Typesettercms vulnerabilities, severities, and proof-of-concept exploits.

Typesettercms products with known CVEs

ProductCVEs
Typesetter14
Typesettercms CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2025-71166Medium5.42026-01-14Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools S…
CVE-2025-71165Medium5.42026-01-14Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools S…
CVE-2025-71164Medium5.42026-01-14Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (su…
CVE-2022-25523High8.82022-03-25TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request.
CVE-2020-19511Medium6.12021-06-21Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes,
CVE-2020-35126Medium4.82020-12-11Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report…
CVE-2020-25790High7.22020-09-19Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the signi…
CVE-2019-20077Medium4.32020-01-05The Typesetter CMS 5.1 logout functionality is affected by a CSRF vulnerability. The logout function of the admin panel is not protected by any CSRF tokens. An…
CVE-2018-16639Medium5.42019-05-13Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.
CVE-2018-16626Medium4.82019-05-13index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name.
CVE-2018-16625Medium4.82019-05-13index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
CVE-2018-20837Medium4.82019-05-09include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS.
CVE-2018-6889High8.82018-02-12An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can poison the web cache…
CVE-2018-6888High8.02018-02-12An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgery: using a forged…