PackagistPackage

typo3/cms-core

99 known vulnerabilities (21 high, 53 medium, 7 low), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 99 · 21 high, 53 medium, 7 low

Registry: Packagist

Advisories 99

CVE-2026-19418High 7.3
TYPO3 CMS - Broken Access Control in Backend and Install Tool
Affected: from 13.0.0, fixed in 13.4.34; from 14.0.0, fixed in 14.3.6; from 14.0.0, fixed in 14.3.6.
CVE-2026-49742High 7.1
TYPO3 CMS - Broken Access Control in Media Module
Affected: from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-49741High 8.7
TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework
Affected: from 14.0.0, fixed in 14.3.3.
CVE-2026-49740Medium 6.3
TYPO3 CMS - Insecure Deserialization in Core API
Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-49738Low 2.1
TYPO3 CMS - Broken Access Control in File Abstraction Layer
Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-47352Medium 5.3
TYPO3 CMS - Broken Access Control in Backend API
Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-47351Medium 5.3
TYPO3 CMS - Broken Access Control in Clipboard
Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-47350Medium 5.3
TYPO3 CMS - Broken Access Control in DataHandler
Affected: from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-47349Medium 5.3
TYPO3 CMS - Broken Access Control in Recycler
Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-47348Medium 5.1
TYPO3 CMS - Cross-Site Scripting in Indexed Search
Affected: from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-47347Medium 5.3
TYPO3 CMS - Open Redirect in Core Utilities
Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-47346High 7.6
TYPO3 CMS - Broken Access Control in Form Framework
Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-47343High 7.2
TYPO3 CMS - Destructive Actions on File Mount Folders
Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-11607High 7.6
TYPO3 CMS - Broken Access Control in Form Framework
Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.
CVE-2026-0859Medium 5.2
TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool
Affected: from 10.0.0, fixed in 10.4.55; from 11.0.0, fixed in 11.5.49; from 12.0.0, fixed in 12.4.41; from 13.0.0, fixed in 13.4.23; from 14.0.0, fixed in 14.0.2; from 14.0.0, fixed in 14.0.2; from 13.0.0, fixed in 13.4.23; from 12.0.0, fixed in 12.4.41; from 11.0.0, fixed in 11.5.49; from 10.0.0, fixed in 10.4.55.

Show all 99 advisoriesShow fewer advisories

CVE-2025-59016Medium 5.3
Information Disclosure via File Abstraction Layer
Affected: from 9.0.0, fixed in 9.5.55; from 10.0.0, fixed in 10.4.54; from 11.0.0, fixed in 11.5.48; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 9.0.0, fixed in 12.4.37; from 10.0.0, fixed in 12.4.37; from 11.0.0, fixed in 12.4.37; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18.
CVE-2025-59015Medium 6.3
Insufficient Entropy in Password Generation
Affected: from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18.
CVE-2025-59013Medium 5.3
Open Redirect in TYPO3 CMS
Affected: from 9.0.0, fixed in 9.5.55; from 10.0.0, fixed in 10.4.54; from 11.0.0, fixed in 11.5.48; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 9.0.0, fixed in 12.4.37; from 10.0.0, fixed in 12.4.37; from 11.0.0, fixed in 12.4.37; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18.
CVE-2025-47940High 7.2
TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer
Affected: from 10.4.0, fixed in 10.4.50; from 11.0.0, fixed in 11.5.44; from 12.0.0, fixed in 12.4.31; from 13.0.0, fixed in 13.4.12.
CVE-2025-47939Medium 5.4
TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer
Affected: from 9.0.0, fixed in 9.5.51; from 10.0.0, fixed in 10.4.50; from 11.0.0, fixed in 11.5.44; from 12.0.0, fixed in 12.4.31; from 13.0.0, fixed in 13.4.12.
CVE-2025-47938Low 3.8
TYPO3 Vulnerable to Unverified Password Change for Backend Users
Affected: from 9.0.0, fixed in 9.5.51; from 10.0.0, fixed in 10.4.50; from 11.0.0, fixed in 11.5.44; from 12.0.0, fixed in 12.4.31; from 13.0.0, fixed in 13.4.12.
CVE-2025-47937Low 3.7
TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling
Affected: from 9.0.0, fixed in 9.5.51; from 10.0.0, fixed in 10.4.50; from 11.0.0, fixed in 11.5.44; from 12.0.0, fixed in 12.4.31; from 13.0.0, fixed in 13.4.12.
CVE-2024-55892Medium 4.8
Potential Open Redirect via Parsing Differences in TYPO3
Affected: from 9.0.0, fixed in 9.5.49; from 10.0.0, fixed in 10.4.48; from 11.0.0, fixed in 11.5.42; from 12.0.0, fixed in 12.4.25; from 13.0.0, fixed in 13.4.3.
CVE-2024-34358Medium 5.3
TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController
Affected: from 9.0.0, fixed in 9.5.48; from 10.0.0, fixed in 10.4.45; from 11.0.0, fixed in 11.5.37; from 12.0.0, fixed in 12.4.15; from 13.0.0, fixed in 13.1.1.
CVE-2024-34357Medium 5.4
TYPO3 vulnerable to Cross-Site Scripting in ShowImageController
Affected: from 9.0.0, fixed in 9.5.48; from 10.0.0, fixed in 10.4.45; from 11.0.0, fixed in 11.5.37; from 12.0.0, fixed in 12.4.15; from 13.0.0, fixed in 13.1.1.
CVE-2024-34356Medium 5.4
TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
Affected: from 9.0.0, fixed in 9.5.48; from 10.0.0, fixed in 10.4.45; from 11.0.0, fixed in 11.5.37; from 12.0.0, fixed in 12.4.15; from 13.0.0, fixed in 13.1.1.
CVE-2024-34355Low 3.5
TYPO3 vulnerable to an HTML Injection in the History Module
Affected: from 13.0.0, fixed in 13.1.1.
CVE-2024-22188High 7.2
TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the…
Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.
CVE-2024-25118Medium 4.3
Information Disclosure of Hashed Passwords in TYPO3 Backend Forms
Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.
CVE-2024-25119Medium 4.9
Information Disclosure of Encryption Key in TYPO3 Install Tool
Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.
CVE-2024-25120Medium 4.3
Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3
Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.
CVE-2024-25121High 7.1
Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3
Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.
CVE-2023-30451Unrated
In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via…
Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.
CVE-2023-47127Medium 4.2
Weak Authentication in Session Handling in typo3/cms-core
Affected: from 8.0.0, fixed in 8.7.55; from 9.0.0, fixed in 9.5.44; from 10.0.0, fixed in 10.4.41; from 11.0.0, fixed in 11.5.33; from 12.0.0, fixed in 12.4.8.
CVE-2023-38499Low 3.7
typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution
Affected: from 9.4.0, fixed in 9.5.42; from 10.0.0, fixed in 10.4.39; from 11.0.0, fixed in 11.5.30; from 12.0.0, fixed in 12.4.4.
CVE-2023-24814High 8.8
Persisted Cross-Site Scripting in Frontend Rendering in typo3
Affected: from 12.0.0, fixed in 12.2.0; from 11.0.0, fixed in 11.5.23; from 10.0.0, fixed in 10.4.36; from 9.0.0, fixed in 9.5.40; from 8.7.0, fixed in 8.7.51.
CVE-2022-23504Medium 5.7
TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration
Affected: from 9.0.0, fixed in 9.5.38; from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.
CVE-2022-23503High 7.5
TYPO3 vulnerable to Arbitrary Code Execution via Form Framework
Affected: from 8.0.0, fixed in 8.7.49; from 9.0.0, fixed in 9.5.38; from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.
CVE-2022-23502Medium 5.4
TYPO3 contains Insufficient Session Expiration after Password Reset
Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.
CVE-2022-23501Medium 5.9
TYPO3 vulnerable to Improper Authentication in Frontend Login
Affected: fixed in 8.7.49; from 9.0.0, fixed in 9.5.38; from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.
CVE-2022-23500Medium 5.9
TYPO3 subject to Uncontrolled Recursion resulting in Denial of Service
Affected: from 9.0.0, fixed in 9.5.38; from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20.
CVE-2022-36105Medium 5.3
User Enumeration via Response Timing in TYPO3
Affected: from 7.0.0, fixed in 7.6.58; from 8.0.0, fixed in 8.7.48; from 9.0.0, fixed in 9.5.37; from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.
CVE-2022-36106Medium 5.4
Missing check for expiration time of password reset token in TYPO3
Affected: from 10.4.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.
CVE-2022-36107Medium 6.5
Stored Cross-Site Scripting via FileDumpController
Affected: from 7.0.0, fixed in 7.6.58; from 8.0.0, fixed in 8.7.48; from 9.0.0, fixed in 9.5.37; from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.
CVE-2022-36104Medium 5.9
Denial of Service via Page Error Handling in TYPO3/cms
Affected: from 11.4.0, fixed in 11.5.16.
CVE-2022-36108Medium 6.5
Cross-Site Scripting in typo3/cms-core
Affected: from 10.3.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.
CVE-2022-36020Medium 6.1
Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer
Affected: from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.
CVE-2022-31050Medium 6.0
Insufficient Session Expiration in TYPO3 Admin Tool
Affected: from 9.0.0, fixed in 9.5.35; from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.
CVE-2022-31048Medium 5.4
Cross-Site Scripting in Form Framework
Affected: from 8.0.0, fixed in 8.7.47; from 9.0.0, fixed in 9.5.35; from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.
CVE-2022-31049Medium 5.4
Cross-Site Scripting in Frontend Login Mailer
Affected: from 9.0.0, fixed in 9.5.35; from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.
CVE-2022-31046Medium 4.3
Information Disclosure via Export Module in TYPO3 CMS
Affected: from 7.0.0, fixed in 7.6.57; from 8.0.0, fixed in 8.7.47; from 9.0.0, fixed in 9.5.35; from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.
CVE-2022-31047Medium 5.3
Insertion of Sensitive Information into Log File in typo3/cms-core
Affected: from 7.0.0, fixed in 7.6.57; from 8.0.0, fixed in 8.7.47; from 9.0.0, fixed in 9.5.35; from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.
CVE-2021-41113High 8.8
Cross-Site-Request-Forgery in Backend URI Handling in Typo3
Affected: from 11.2.0, fixed in 11.5.0.
CVE-2021-41114Medium 4.8
HTTP Host Header Injection in Request Handling in Typo3
Affected: from 11.0.0, fixed in 11.5.0.
CVE-2021-32768Medium 6.1
Cross-Site Scripting via Rich-Text Content
Affected: from 7.0.0, fixed in 7.6.53; from 8.0.0, fixed in 8.7.42; from 10.0.0, fixed in 10.4.19; from 11.0.0, fixed in 11.3.2; from 9.0.0, fixed in 9.5.29.
CVE-2021-32767Medium 5.3
Information Disclosure in User Authentication
Affected: from 7.0.0, fixed in 7.6.52; from 8.0.0, fixed in 8.7.41; from 9.0.0, fixed in 9.5.28; from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1.
CVE-2021-32669Medium 6.4
Cross-Site Scripting in Backend Grid View
Affected: from 8.0.0, fixed in 8.7.41; from 9.0.0, fixed in 9.5.28; from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1.
CVE-2021-32668Medium 6.4
Cross-Site Scripting in Query Generator & Query View
Affected: from 8.0.0, fixed in 8.7.41; from 9.0.0, fixed in 9.5.28; from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1.
CVE-2021-32667Medium 6.4
Cross-Site Scripting in Page Preview
Affected: from 9.0.0, fixed in 9.5.28; from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1.
CVE-2021-21359Medium 5.9
Denial of Service in Page Error Handling
Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.
CVE-2021-21370Medium 5.4
Cross-Site Scripting in Content Preview (CType menu)
Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.
CVE-2021-21339Medium 5.9
Cleartext storage of session identifier
Affected: from 6.2.0, fixed in 6.2.57; from 7.0.0, fixed in 7.6.51; from 8.0.0, fixed in 8.7.40; from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.
CVE-2021-21340Medium 5.4
Cross-Site Scripting in Content Preview
Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.
CVE-2021-21355High 8.6
Unrestricted File Upload in Form Framework
Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.
CVE-2021-21357High 8.3
Broken Access Control in Form Framework
Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.
CVE-2021-21358Medium 5.4
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form
Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.
CVE-2021-21338Medium 4.7
Open Redirection in Login Handling
Affected: from 6.2.0, fixed in 6.2.57; from 7.0.0, fixed in 7.6.51; from 8.0.0, fixed in 8.7.40; from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.
CVE-2020-26229Low 3.7
XML External Entity in Dashboard Widget
Affected: from 10.0.0, fixed in 10.4.10.
CVE-2020-26228High 8.1
Cleartext storage of session identifier
Affected: from 9.0.0, fixed in 9.5.23; from 10.0.0, fixed in 10.4.10; from 8.7.0, fixed in 8.7.38.
CVE-2020-26227Medium 6.1
Cross-Site Scripting in Fluid view helpers
Affected: from 9.0.0, fixed in 9.5.23; from 10.0.0, fixed in 10.4.10; from 8.7.0, fixed in 8.7.38.
CVE-2020-15241Medium 4.7
Cross-Site Scripting in TYPO3 Fluid Engine
Affected: from 8.0.0, fixed in 8.7.25; from 9.0.0, fixed in 9.5.6.
CVE-2020-15098High 8.8
Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS
Affected: from 9.0.0, fixed in 9.5.20; from 10.0.0, fixed in 10.4.6.
CVE-2020-15099High 8.1
Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS
Affected: from 9.0.0, fixed in 9.5.20; from 10.0.0, fixed in 10.4.6.
CVE-2020-11069High 8.0
Cross-Site Request Forgery in TYPO3 CMS
Affected: from 9.0.0, fixed in 9.5.17; from 10.0.0, fixed in 10.4.2.
CVE-2020-11067High 8.8
Deserialization of Untrusted Data in TYPO3 CMS
Affected: from 9.0.0, fixed in 9.5.17; from 10.0.0, fixed in 10.4.2.
CVE-2020-11066High 8.7
Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS
Affected: from 9.0.0, fixed in 9.5.17; from 10.0.0, fixed in 10.4.2.
CVE-2020-11065Medium 5.4
Cross-Site Scripting in TYPO3 CMS
Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.
CVE-2020-11064Medium 5.4
Cross-Site Scripting in TYPO3 CMS
Affected: from 9.0.0, fixed in 9.5.17; from 10.0.0, fixed in 10.4.2.
CVE-2020-11063Low 3.7
Observable Response Discrepancy in TYPO3 CMS
Affected: from 10.0.0, fixed in 10.4.2.
CVE-2019-19849High 8.8
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.
Affected: from 10.0.0, fixed in 10.2.1; from 8.0.0, fixed in 8.7.30; from 9.0.0, fixed in 9.5.12.
CVE-2019-19850Medium 5.5
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.
Affected: from 8.0, fixed in 8.7.30; from 9.0, fixed in 9.5.12; from 10.0, fixed in 10.2.2.
CVE-2019-19848Medium 6.8
An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.
Affected: from 10.0.0, fixed in 10.2.2; from 8.0.0, fixed in 8.7.30; from 9.0.0, fixed in 9.5.12.
CVE-2010-3673Unrated
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API.
Affected: fixed in 4.2.13; from 4.3, fixed in 4.3.4; from 4.4, fixed in 4.4.1.
CVE-2019-12748Unrated
TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.
Affected: from 8.0.0, fixed in 8.7.27; from 9.0.0, fixed in 9.5.8.
CVE-2019-12747Unrated
TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.
Affected: from 8.0.0, fixed in 8.7.27; from 9.0.0, fixed in 9.5.8.
CVE-2019-10912Unrated
In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain…
Affected: from 9.0.0, fixed in 9.5.8.
CVE-2019-11832Unrated
TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for…
Affected: from 8.0.0, fixed in 8.7.25; from 9.0.0, fixed in 9.5.6.
CVE-2018-17960Unrated
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
Affected: from 8.0.0, fixed in 8.7.21; from 9.0.0, fixed in 9.5.2.
CVE-2018-14041Unrated
In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.
Affected: from 8.0.0, fixed in 8.7.23; from 9.0.0, fixed in 9.5.4.
CVE-2013-4320Unrated
The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows…
Affected: from 6.0, fixed in 6.0.9; from 6.1, fixed in 6.1.4.
CVE-2013-7078Unrated
Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3…
Affected: from 4.5.0, fixed in 4.5.31; from 4.7.0, fixed in 4.7.16; from 6.1.0, fixed in 6.1.6; from 6.0.0, fixed in 6.0.11.
CVE-2013-7081Unrated
The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through…
Affected: from 4.5.0, fixed in 4.5.31; from 4.7.0, fixed in 4.7.16; from 6.0.0, fixed in 6.0.11; from 6.1.0, fixed in 6.1.6.
CVE-2013-7080Unrated
The creating record functionality in Extension table administration library (feuser_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0…
Affected: from 4.5.0, fixed in 4.5.31; from 4.6.0, fixed in 4.7.16; from 6.0.0, fixed in 6.0.11.
CVE-2013-7077Unrated
Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7…
Affected: from 6.0, fixed in 6.0.12; from 6.1, fixed in 6.1.7.
CVE-2013-1843Unrated
Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and…
Affected: from 4.5.0, fixed in 4.5.24; from 4.6.0, fixed in 4.6.17; from 4.7.0, fixed in 4.7.9; from 6.0.0, fixed in 6.0.3.
CVE-2013-1842Unrated
SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x…
Affected: from 4.5.0, fixed in 4.5.24; from 4.6.0, fixed in 4.6.17; from 4.7.0, fixed in 4.7.9; from 6.0.0, fixed in 6.0.3.
CVE-2010-5104Unrated
The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when…
Affected: from 4.2.0, fixed in 4.2.16; from 4.3.0, fixed in 4.3.9; from 4.4.0, fixed in 4.4.5.
CVE-2009-3633Unrated
Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13…
Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3alpha1, fixed in 4.3beta2.
CVE-2008-2717Unrated
TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for…
Affected: from 4.0.0, fixed in 4.0.9; from 4.1.0, fixed in 4.1.7; from 4.2.0, fixed in 4.2.1.