Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

typo3/cms-backend

26 known vulnerabilities (3 high, 10 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
26 · 3 high, 10 medium, 1 low
Registry
Packagist

Advisories 26

  • CVE-2026-77132Medium 5.3

    TYPO3 CMS - Information Disclosure via Backend Localization Wizard

    Affected: from 10.0.0, fixed in 10.4.60; from 11.0.0, fixed in 11.5.54; from 12.0.0, fixed in 12.4.49; from 13.0.0, fixed in 13.4.35; from 14.0.0, fixed in 14.3.7.

  • TYPO3 CMS - Broken Access Control in Backend and Install Tool

    Affected: from 13.0.0, fixed in 13.4.34; from 14.0.0, fixed in 14.3.6; from 13.0.0, fixed in 13.4.34.

  • CVE-2026-47352Medium 5.3

    TYPO3 CMS - Broken Access Control in Backend API

    Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

  • CVE-2026-47351Medium 5.3

    TYPO3 CMS - Broken Access Control in Clipboard

    Affected: from 10.4.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

  • TYPO3 CMS Stores Cleartext Password in User Settings Module

    Affected: from 14.2.0, fixed in 14.3.0; from 14.2.0, fixed in 14.3.0.

  • CVE-2025-59020Medium 5.3

    TYPO3 CMS Allows Broken Access Control in Edit Document Controller

    Affected: from 10.0.0, fixed in 10.4.55; from 11.0.0, fixed in 11.5.49; from 12.0.0, fixed in 12.4.41; from 13.0.0, fixed in 13.4.23; from 14.0.0, fixed in 14.0.2; from 14.0.0, fixed in 14.0.2; from 13.0.0, fixed in 13.4.23; from 12.0.0, fixed in 12.4.41; from 11.0.0, fixed in 11.5.49; from 10.0.0, fixed in 10.4.55.

  • CVE-2025-59019Medium 5.3

    Information Disclosure via CSV Download

    Affected: from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18.

  • CVE-2025-59017Medium 5.3

    Broken Access Control in Backend AJAX Routes

    Affected: from 9.0.0, fixed in 9.5.55; from 10.0.0, fixed in 10.4.54; from 11.0.0, fixed in 11.5.48; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 9.0.0, fixed in 12.4.37; from 10.0.0, fixed in 12.4.37; from 11.0.0, fixed in 12.4.37; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18.

  • CVE-2025-59014Medium 5.1

    Denial of Service in TYPO3 Bookmark Toolbar

    Affected: from 11.0.0, fixed in 11.5.48; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 11.0.0, fixed in 12.4.37; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18.

  • TYPO3 Has Broken Authentication in Backend MFA

    Affected: from 12.0.0, fixed in 12.4.31; from 13.0.0, fixed in 13.4.12.

  • CVE-2024-34537Medium 4.9

    TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an…

    Affected: from 13.0.0, fixed in 13.3.1; from 12.0.0, fixed in 12.4.21; from 11.0.0, fixed in 11.5.40; from 10.0.0, fixed in 10.4.46.

  • Information Disclosure in TYPO3 Page Tree

    Affected: from 13.0.0, fixed in 13.3.1; from 12.0.0, fixed in 12.4.21; from 11.0.0, fixed in 11.5.40; from 10.0.0, fixed in 10.4.46.

  • CVE-2021-21370Medium 5.4

    Cross-Site Scripting in Content Preview (CType menu)

    Affected: from 7.0.0, fixed in 7.6.51; from 8.0.0, fixed in 8.7.40; from 9.0.0, fixed in 9.5.25; from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.

  • CVE-2021-21340Medium 5.4

    Cross-Site Scripting in Content Preview

    Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.

  • TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend.

    Affected: fixed in 4.1.14; from 4.2.0, fixed in 4.2.13; from 4.3.0, fixed in 4.3.4; from 4.4.0, fixed in 4.4.1.

Show all 26 advisoriesShow fewer advisories

  • TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable…

    Affected: fixed in 4.1.14; from 4.2, fixed in 4.2.13; from 4.3, fixed in 4.3.4; from 4.4, fixed in 4.4.1.

  • TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.

    Affected: fixed in 4.1.14; from 4.2.0, fixed in 4.2.13; from 4.3.0, fixed in 4.3.4; from 4.4.0, fixed in 4.4.1.

  • TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend.

    Affected: fixed in 4.1.14; from 4.2.0, fixed in 4.2.13; from 4.3.0, fixed in 4.3.4; from 4.4.0, fixed in 4.4.1.

  • TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend.

    Affected: fixed in 4.1.14; from 4.2.0, fixed in 4.2.13; from 4.3.0, fixed in 4.3.4; from 4.4.0, fixed in 4.4.1.

  • Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x…

    Affected: from 4.1.0, fixed in 4.1.14; from 4.2.0, fixed in 4.2.13; from 4.3.0, fixed in 4.3.4; from 4.4.0, fixed in 4.4.1.

  • Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote…

    Affected: from 4.2.0, fixed in 4.2.15; from 4.3.0, fixed in 4.3.7; from 4.4.0, fixed in 4.4.4.

  • The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2, when the DAM…

    Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3alpha1, fixed in 4.3beta2.

  • The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote…

    Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3alpha1, fixed in 4.3beta2.

  • Multiple cross-site scripting (XSS) vulnerabilities in the Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x…

    Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3alpha1, fixed in 4.3beta2.

  • The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote…

    Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3alpha1, fixed in 4.3beta2.

  • Cross-site scripting (XSS) vulnerability in the file backend module in TYPO3 4.2.2 allows remote attackers to inject arbitrary web script…

    Affected: from 4.2.2, fixed in 4.2.3.