TYPO3
Page 2 of 6 — TYPO3 CVEs from a corpus of 589, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-47780 | Low | 3.1 | 2024-10-08 | TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointe… |
CVE-2024-34358 | Medium | 5.3 | 2024-05-14 | TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1… |
CVE-2024-34357 | Medium | 5.4 | 2024-05-14 | TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1… |
CVE-2024-34356 | Medium | 5.4 | 2024-05-14 | TYPO3 is an enterprise content management system. Starting in version 9.0.0 and prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1… |
CVE-2024-34355 | Low | 3.5 | 2024-05-14 | TYPO3 is an enterprise content management system. Starting in version 13.0.0 and prior to version 13.1.1, the history backend module is vulnerable to HTML inje… |
CVE-2024-22188 | High | 7.2 | 2024-03-05 | TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web… |
CVE-2024-25121 | High | 7.1 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Laye… |
CVE-2024-25120 | Medium | 4.3 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. The TYPO3-specific `t3://` URI scheme could be used to access resou… |
CVE-2024-25119 | Medium | 4.9 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displ… |
CVE-2024-25118 | Medium | 4.3 | 2024-02-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password hashes were being reflected in the editing forms of the TY… |
CVE-2023-30451 | Medium | 4.9 | 2023-12-25 | In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the b… |
CVE-2023-47127 | Medium | 4.2 | 2023-11-14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different site… |
CVE-2023-47126 | Low | 3.7 | 2023-11-14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install too… |
CVE-2023-47125 | Medium | 4.7 | 2023-11-14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled co… |
CVE-2023-38500 | Medium | 4.7 | 2023-07-25 | TYPO3 HTML Sanitizer is an HTML sanitizer, written in PHP, aiming to provide cross-site-scripting-safe markup based on explicitly allowed tags, attributes and… |
CVE-2023-38499 | Low | 3.7 | 2023-07-25 | TYPO3 is an open source PHP based web content management system. Starting in version 9.4.0 and prior to versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, and 12.4.4… |
CVE-2023-37905 | Medium | 6.1 | 2023-07-21 | ckeditor-wordcount-plugin is an open source WordCount Plugin for CKEditor. It has been discovered that the `ckeditor-wordcount-plugin` plugin for CKEditor4 is… |
CVE-2023-24814 | High | 8.8 | 2023-02-07 | TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `Gene… |
CVE-2022-23504 | Medium | 5.7 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Di… |
CVE-2022-23503 | High | 7.5 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injectio… |
CVE-2022-23502 | Medium | 5.4 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the c… |
CVE-2022-23501 | Medium | 5.9 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Impro… |
CVE-2022-23500 | Medium | 5.9 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing… |
CVE-2022-23499 | Medium | 6.1 | 2022-12-13 | HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1… |
CVE-2022-36108 | Medium | 6.5 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `f:asset.css` view helper is vulner… |
CVE-2022-36107 | Medium | 6.5 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the `FileDumpController` (backend and f… |
CVE-2022-36106 | Medium | 5.4 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the expiration time of a password reset… |
CVE-2022-36105 | Medium | 5.3 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that observing response time during user aut… |
CVE-2022-36104 | Medium | 5.9 | 2022-09-13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources v… |
CVE-2022-36020 | Medium | 6.1 | 2022-09-13 | The typo3/html-sanitizer package is an HTML sanitizer, written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and value… |
CVE-2022-31050 | Medium | 6.0 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend… |
CVE-2022-31049 | Medium | 5.4 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being prope… |
CVE-2022-31048 | Medium | 5.4 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of th… |
CVE-2022-31047 | Medium | 5.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentia… |
CVE-2022-31046 | Medium | 4.3 | 2022-06-14 | TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality… |
CVE-2021-41114 | Medium | 4.8 | 2021-10-05 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofi… |
CVE-2021-41113 | High | 8.8 | 2021-10-05 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that the new TYPO3 v11 feature that allows u… |
CVE-2021-32768 | Medium | 6.1 | 2021-08-10 | TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode… |
CVE-2021-32767 | Medium | 5.3 | 2021-07-20 | TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user cred… |
CVE-2021-32669 | Medium | 6.4 | 2021-07-20 | TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-… |
CVE-2021-32668 | Medium | 6.4 | 2021-07-20 | TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-… |
CVE-2021-32667 | Medium | 6.4 | 2021-07-20 | TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-… |
CVE-2021-21365 | Medium | 5.4 | 2021-04-27 | Bootstrap Package is a theme for TYPO3. It has been discovered that rendering content in the website frontend is vulnerable to cross-site scripting. A valid ba… |
CVE-2021-21370 | Medium | 5.4 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that c… |
CVE-2021-21359 | Medium | 5.9 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources… |
CVE-2021-21358 | Medium | 5.4 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that the Form Designer backend… |
CVE-2021-21357 | High | 8.3 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 due to improper input validation, att… |
CVE-2021-21355 | High | 8.6 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file ext… |
CVE-2021-21340 | Medium | 5.4 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as _… |
CVE-2021-21339 | Medium | 5.9 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 user session identifi… |
CVE-2021-21338 | Medium | 4.7 | 2021-03-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovere… |
CVE-2020-26229 | Low | 3.7 | 2020-11-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML e… |
CVE-2020-26228 | High | 8.1 | 2020-11-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 user session identifiers were stored in cleartext… |
CVE-2020-26227 | Medium | 6.1 | 2020-11-23 | TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.23 and 10.4.10 the system extension Fluid (typo3/cms-fluid) of th… |
CVE-2020-26216 | High | 8.0 | 2020-11-17 | TYPO3 Fluid before versions 2.0.8, 2.1.7, 2.2.4, 2.3.7, 2.4.4, 2.5.11 and 2.6.10 is vulnerable to Cross-Site Scripting. Three XSS vulnerabilities have been det… |
CVE-2020-15241 | Medium | 4.7 | 2020-10-08 | TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when ma… |
CVE-2020-15099 | High | 8.1 | 2020-07-29 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages… |
CVE-2020-15098 | High | 8.8 | 2020-07-29 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an inte… |
CVE-2020-15086 | Critical | 9.8 | 2020-07-29 | In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism… |
CVE-2020-11069 | High | 8.0 | 2020-05-14 | In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-s… |
CVE-2020-11067 | High | 8.8 | 2020-05-14 | In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure des… |
CVE-2020-11066 | High | 8.7 | 2020-05-14 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious u… |
CVE-2020-11065 | Medium | 5.4 | 2020-05-13 | In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link t… |
CVE-2020-11064 | Medium | 5.4 | 2020-05-13 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML pla… |
CVE-2020-11063 | Low | 3.7 | 2020-05-13 | In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users. Th… |
CVE-2020-11070 | Medium | 5.4 | 2020-05-13 | The SVG Sanitizer extension for TYPO3 has a cross-site scripting vulnerability in versions before 1.0.3. Slightly invalid or incomplete SVG markup is not corre… |
CVE-2020-8091 | Medium | 6.1 | 2020-01-27 | svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a ta… |
CVE-2019-19850 | High | 7.2 | 2019-12-17 | An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. Because escaping of user-submitted content is mishandled, the class… |
CVE-2019-19849 | High | 8.8 | 2019-12-17 | An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the classes QueryGenerator and QueryView… |
CVE-2019-19848 | High | 7.2 | 2019-12-17 | An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. It has been discovered that the extraction of manually uploaded ZIP… |
CVE-2011-3583 | Critical | 9.8 | 2019-11-26 | It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injec… |
CVE-2011-4904 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint… |
CVE-2011-4903 | Medium | 6.1 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2011-4902 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver. |
CVE-2011-4901 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database. |
CVE-2011-4900 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.5.4 allows Information Disclosure in the backend. |
CVE-2011-4632 | Medium | 5.4 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2011-4631 | Medium | 5.4 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2011-4630 | Medium | 5.4 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2011-4629 | Medium | 5.4 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2011-4628 | Critical | 9.8 | 2019-11-06 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted re… |
CVE-2011-4627 | Medium | 6.5 | 2019-11-06 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend. |
CVE-2011-4626 | Medium | 6.1 | 2019-11-06 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML vi… |
CVE-2010-3674 | Medium | 6.1 | 2019-11-05 | TYPO3 before 4.4.1 allows XSS in the frontend search box. |
CVE-2010-3673 | Medium | 5.3 | 2019-11-05 | TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API. |
CVE-2010-3672 | Medium | 6.1 | 2019-11-05 | TYPO3 before 4.3.4 and 4.4.x before 4.4.1 allows XSS in the textarea view helper in an extbase extension. |
CVE-2010-3671 | Medium | 6.5 | 2019-11-05 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijac… |
CVE-2010-3670 | Medium | 4.8 | 2019-11-05 | TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot password" function. |
CVE-2010-3669 | Medium | 5.4 | 2019-11-04 | TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box. |
CVE-2010-3668 | High | 7.5 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Header Injection in the secure download feature jumpurl. |
CVE-2010-3667 | Medium | 5.3 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element. |
CVE-2010-3666 | Medium | 5.3 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function. |
CVE-2010-3665 | Medium | 5.4 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager. |
CVE-2010-3664 | Medium | 6.5 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend. |
CVE-2010-3663 | High | 8.8 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which co… |
CVE-2010-3662 | High | 8.8 | 2019-11-04 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend. |
CVE-2010-3661 | Medium | 6.1 | 2019-11-01 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend. |
CVE-2010-3660 | Medium | 5.4 | 2019-11-01 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend. |
CVE-2019-12748 | Medium | 6.1 | 2019-07-09 | TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS. |
CVE-2019-12747 | High | 8.8 | 2019-07-09 | TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data. |