# typo3/cms-core (Packagist) vulnerabilities

99 known vulnerabilities (21 high, 53 medium, 7 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/typo3/cms-core

## Advisories (99)

### [CVE-2026-19418](https://cve.now/CVE-2026-19418): TYPO3 CMS - Broken Access Control in Backend and Install Tool

- Severity: High 7.3
- Published: Aug 11, 2026
- Affected: from 13.0.0, fixed in 13.4.34; from 14.0.0, fixed in 14.3.6; from 14.0.0, fixed in 14.3.6.

### [CVE-2026-49742](https://cve.now/CVE-2026-49742): TYPO3 CMS - Broken Access Control in Media Module

- Severity: High 7.1
- Published: Jun 9, 2026
- Affected: from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-49741](https://cve.now/CVE-2026-49741): TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework

- Severity: High 8.7
- Published: Jun 9, 2026
- Affected: from 14.0.0, fixed in 14.3.3.

### [CVE-2026-49740](https://cve.now/CVE-2026-49740): TYPO3 CMS - Insecure Deserialization in Core API

- Severity: Medium 6.3
- Published: Jun 9, 2026
- Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-49738](https://cve.now/CVE-2026-49738): TYPO3 CMS - Broken Access Control in File Abstraction Layer

- Severity: Low 2.1
- Published: Jun 9, 2026
- Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-47352](https://cve.now/CVE-2026-47352): TYPO3 CMS - Broken Access Control in Backend API

- Severity: Medium 5.3
- Published: Jun 9, 2026
- Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-47351](https://cve.now/CVE-2026-47351): TYPO3 CMS - Broken Access Control in Clipboard

- Severity: Medium 5.3
- Published: Jun 9, 2026
- Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-47350](https://cve.now/CVE-2026-47350): TYPO3 CMS - Broken Access Control in DataHandler

- Severity: Medium 5.3
- Published: Jun 9, 2026
- Affected: from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-47349](https://cve.now/CVE-2026-47349): TYPO3 CMS - Broken Access Control in Recycler

- Severity: Medium 5.3
- Published: Jun 9, 2026
- Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-47348](https://cve.now/CVE-2026-47348): TYPO3 CMS - Cross-Site Scripting in Indexed Search

- Severity: Medium 5.1
- Published: Jun 9, 2026
- Affected: from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-47347](https://cve.now/CVE-2026-47347): TYPO3 CMS - Open Redirect in Core Utilities

- Severity: Medium 5.3
- Published: Jun 9, 2026
- Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-47346](https://cve.now/CVE-2026-47346): TYPO3 CMS - Broken Access Control in Form Framework

- Severity: High 7.6
- Published: Jun 9, 2026
- Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-47343](https://cve.now/CVE-2026-47343): TYPO3 CMS - Destructive Actions on File Mount Folders

- Severity: High 7.2
- Published: Jun 9, 2026
- Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-11607](https://cve.now/CVE-2026-11607): TYPO3 CMS - Broken Access Control in Form Framework

- Severity: High 7.6
- Published: Jun 9, 2026
- Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

### [CVE-2026-0859](https://cve.now/CVE-2026-0859): TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

- Severity: Medium 5.2
- Published: Jan 13, 2026
- Affected: from 10.0.0, fixed in 10.4.55; from 11.0.0, fixed in 11.5.49; from 12.0.0, fixed in 12.4.41; from 13.0.0, fixed in 13.4.23; from 14.0.0, fixed in 14.0.2; from 14.0.0, fixed in 14.0.2; from 13.0.0, fixed in 13.4.23; from 12.0.0, fixed in 12.4.41; from 11.0.0, fixed in 11.5.49; from 10.0.0, fixed in 10.4.55.

### [CVE-2025-59016](https://cve.now/CVE-2025-59016): Information Disclosure via File Abstraction Layer

- Severity: Medium 5.3
- Published: Sep 9, 2025
- Affected: from 9.0.0, fixed in 9.5.55; from 10.0.0, fixed in 10.4.54; from 11.0.0, fixed in 11.5.48; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 9.0.0, fixed in 12.4.37; from 10.0.0, fixed in 12.4.37; from 11.0.0, fixed in 12.4.37; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18.

### [CVE-2025-59015](https://cve.now/CVE-2025-59015): Insufficient Entropy in Password Generation

- Severity: Medium 6.3
- Published: Sep 9, 2025
- Affected: from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18.

### [CVE-2025-59013](https://cve.now/CVE-2025-59013): Open Redirect in TYPO3 CMS

- Severity: Medium 5.3
- Published: Sep 9, 2025
- Affected: from 9.0.0, fixed in 9.5.55; from 10.0.0, fixed in 10.4.54; from 11.0.0, fixed in 11.5.48; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18; from 9.0.0, fixed in 12.4.37; from 10.0.0, fixed in 12.4.37; from 11.0.0, fixed in 12.4.37; from 12.0.0, fixed in 12.4.37; from 13.0.0, fixed in 13.4.18.

### [CVE-2025-47940](https://cve.now/CVE-2025-47940): TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer

- Severity: High 7.2
- Published: May 20, 2025
- Affected: from 10.4.0, fixed in 10.4.50; from 11.0.0, fixed in 11.5.44; from 12.0.0, fixed in 12.4.31; from 13.0.0, fixed in 13.4.12.

### [CVE-2025-47939](https://cve.now/CVE-2025-47939): TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer

- Severity: Medium 5.4
- Published: May 20, 2025
- Affected: from 9.0.0, fixed in 9.5.51; from 10.0.0, fixed in 10.4.50; from 11.0.0, fixed in 11.5.44; from 12.0.0, fixed in 12.4.31; from 13.0.0, fixed in 13.4.12.

### [CVE-2025-47938](https://cve.now/CVE-2025-47938): TYPO3 Vulnerable to Unverified Password Change for Backend Users

- Severity: Low 3.8
- Published: May 20, 2025
- Affected: from 9.0.0, fixed in 9.5.51; from 10.0.0, fixed in 10.4.50; from 11.0.0, fixed in 11.5.44; from 12.0.0, fixed in 12.4.31; from 13.0.0, fixed in 13.4.12.

### [CVE-2025-47937](https://cve.now/CVE-2025-47937): TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling

- Severity: Low 3.7
- Published: May 20, 2025
- Affected: from 9.0.0, fixed in 9.5.51; from 10.0.0, fixed in 10.4.50; from 11.0.0, fixed in 11.5.44; from 12.0.0, fixed in 12.4.31; from 13.0.0, fixed in 13.4.12.

### [CVE-2024-55892](https://cve.now/CVE-2024-55892): Potential Open Redirect via Parsing Differences in TYPO3

- Severity: Medium 4.8
- Published: Jan 14, 2025
- Affected: from 9.0.0, fixed in 9.5.49; from 10.0.0, fixed in 10.4.48; from 11.0.0, fixed in 11.5.42; from 12.0.0, fixed in 12.4.25; from 13.0.0, fixed in 13.4.3.

### [CVE-2024-34358](https://cve.now/CVE-2024-34358): TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController

- Severity: Medium 5.3
- Published: May 14, 2024
- Affected: from 9.0.0, fixed in 9.5.48; from 10.0.0, fixed in 10.4.45; from 11.0.0, fixed in 11.5.37; from 12.0.0, fixed in 12.4.15; from 13.0.0, fixed in 13.1.1.

### [CVE-2024-34357](https://cve.now/CVE-2024-34357): TYPO3 vulnerable to Cross-Site Scripting in ShowImageController

- Severity: Medium 5.4
- Published: May 14, 2024
- Affected: from 9.0.0, fixed in 9.5.48; from 10.0.0, fixed in 10.4.45; from 11.0.0, fixed in 11.5.37; from 12.0.0, fixed in 12.4.15; from 13.0.0, fixed in 13.1.1.

### [CVE-2024-34356](https://cve.now/CVE-2024-34356): TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module

- Severity: Medium 5.4
- Published: May 14, 2024
- Affected: from 9.0.0, fixed in 9.5.48; from 10.0.0, fixed in 10.4.45; from 11.0.0, fixed in 11.5.37; from 12.0.0, fixed in 12.4.15; from 13.0.0, fixed in 13.1.1.

### [CVE-2024-34355](https://cve.now/CVE-2024-34355): TYPO3 vulnerable to an HTML Injection in the History Module

- Severity: Low 3.5
- Published: May 14, 2024
- Affected: from 13.0.0, fixed in 13.1.1.

### [CVE-2024-22188](https://cve.now/CVE-2024-22188): TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the…

- Severity: High 7.2
- Published: Mar 5, 2024
- Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.

### [CVE-2024-25118](https://cve.now/CVE-2024-25118): Information Disclosure of Hashed Passwords in TYPO3 Backend Forms

- Severity: Medium 4.3
- Published: Feb 13, 2024
- Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.

### [CVE-2024-25119](https://cve.now/CVE-2024-25119): Information Disclosure of Encryption Key in TYPO3 Install Tool

- Severity: Medium 4.9
- Published: Feb 13, 2024
- Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.

### [CVE-2024-25120](https://cve.now/CVE-2024-25120): Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3

- Severity: Medium 4.3
- Published: Feb 13, 2024
- Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.

### [CVE-2024-25121](https://cve.now/CVE-2024-25121): Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3

- Severity: High 7.1
- Published: Feb 13, 2024
- Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.

### [CVE-2023-30451](https://cve.now/CVE-2023-30451): In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via…

- Severity: Unrated
- Published: Dec 25, 2023
- Affected: from 8.0.0, fixed in 8.7.57; from 9.0.0, fixed in 9.5.46; from 10.0.0, fixed in 10.4.43; from 11.0.0, fixed in 11.5.35; from 12.0.0, fixed in 12.4.11; from 13.0.0, fixed in 13.0.1.

### [CVE-2023-47127](https://cve.now/CVE-2023-47127): Weak Authentication in Session Handling in typo3/cms-core

- Severity: Medium 4.2
- Published: Nov 14, 2023
- Affected: from 8.0.0, fixed in 8.7.55; from 9.0.0, fixed in 9.5.44; from 10.0.0, fixed in 10.4.41; from 11.0.0, fixed in 11.5.33; from 12.0.0, fixed in 12.4.8.

### [CVE-2023-38499](https://cve.now/CVE-2023-38499): typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution

- Severity: Low 3.7
- Published: Jul 25, 2023
- Affected: from 9.4.0, fixed in 9.5.42; from 10.0.0, fixed in 10.4.39; from 11.0.0, fixed in 11.5.30; from 12.0.0, fixed in 12.4.4.

### [CVE-2023-24814](https://cve.now/CVE-2023-24814): Persisted Cross-Site Scripting in Frontend Rendering in typo3

- Severity: High 8.8
- Published: Feb 7, 2023
- Affected: from 12.0.0, fixed in 12.2.0; from 11.0.0, fixed in 11.5.23; from 10.0.0, fixed in 10.4.36; from 9.0.0, fixed in 9.5.40; from 8.7.0, fixed in 8.7.51.

### [CVE-2022-23504](https://cve.now/CVE-2022-23504): TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

- Severity: Medium 5.7
- Published: Dec 14, 2022
- Affected: from 9.0.0, fixed in 9.5.38; from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

### [CVE-2022-23503](https://cve.now/CVE-2022-23503): TYPO3 vulnerable to Arbitrary Code Execution via Form Framework

- Severity: High 7.5
- Published: Dec 14, 2022
- Affected: from 8.0.0, fixed in 8.7.49; from 9.0.0, fixed in 9.5.38; from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

### [CVE-2022-23502](https://cve.now/CVE-2022-23502): TYPO3 contains Insufficient Session Expiration after Password Reset

- Severity: Medium 5.4
- Published: Dec 14, 2022
- Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

### [CVE-2022-23501](https://cve.now/CVE-2022-23501): TYPO3 vulnerable to Improper Authentication in Frontend Login

- Severity: Medium 5.9
- Published: Dec 14, 2022
- Affected: fixed in 8.7.49; from 9.0.0, fixed in 9.5.38; from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

### [CVE-2022-23500](https://cve.now/CVE-2022-23500): TYPO3 subject to Uncontrolled Recursion resulting in Denial of Service

- Severity: Medium 5.9
- Published: Dec 14, 2022
- Affected: from 9.0.0, fixed in 9.5.38; from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20.

### [CVE-2022-36105](https://cve.now/CVE-2022-36105): User Enumeration via Response Timing in TYPO3

- Severity: Medium 5.3
- Published: Sep 13, 2022
- Affected: from 7.0.0, fixed in 7.6.58; from 8.0.0, fixed in 8.7.48; from 9.0.0, fixed in 9.5.37; from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

### [CVE-2022-36106](https://cve.now/CVE-2022-36106): Missing check for expiration time of password reset token in TYPO3

- Severity: Medium 5.4
- Published: Sep 13, 2022
- Affected: from 10.4.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

### [CVE-2022-36107](https://cve.now/CVE-2022-36107): Stored Cross-Site Scripting via FileDumpController

- Severity: Medium 6.5
- Published: Sep 13, 2022
- Affected: from 7.0.0, fixed in 7.6.58; from 8.0.0, fixed in 8.7.48; from 9.0.0, fixed in 9.5.37; from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

### [CVE-2022-36104](https://cve.now/CVE-2022-36104): Denial of Service via Page Error Handling in TYPO3/cms

- Severity: Medium 5.9
- Published: Sep 13, 2022
- Affected: from 11.4.0, fixed in 11.5.16.

### [CVE-2022-36108](https://cve.now/CVE-2022-36108): Cross-Site Scripting in typo3/cms-core

- Severity: Medium 6.5
- Published: Sep 13, 2022
- Affected: from 10.3.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

### [CVE-2022-36020](https://cve.now/CVE-2022-36020): Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer

- Severity: Medium 6.1
- Published: Sep 13, 2022
- Affected: from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

### [CVE-2022-31050](https://cve.now/CVE-2022-31050): Insufficient Session Expiration in TYPO3 Admin Tool

- Severity: Medium 6.0
- Published: Jun 14, 2022
- Affected: from 9.0.0, fixed in 9.5.35; from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

### [CVE-2022-31048](https://cve.now/CVE-2022-31048): Cross-Site Scripting in Form Framework

- Severity: Medium 5.4
- Published: Jun 14, 2022
- Affected: from 8.0.0, fixed in 8.7.47; from 9.0.0, fixed in 9.5.35; from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

### [CVE-2022-31049](https://cve.now/CVE-2022-31049): Cross-Site Scripting in Frontend Login Mailer

- Severity: Medium 5.4
- Published: Jun 14, 2022
- Affected: from 9.0.0, fixed in 9.5.35; from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

### [CVE-2022-31046](https://cve.now/CVE-2022-31046): Information Disclosure via Export Module in TYPO3 CMS

- Severity: Medium 4.3
- Published: Jun 14, 2022
- Affected: from 7.0.0, fixed in 7.6.57; from 8.0.0, fixed in 8.7.47; from 9.0.0, fixed in 9.5.35; from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

### [CVE-2022-31047](https://cve.now/CVE-2022-31047): Insertion of Sensitive Information into Log File in typo3/cms-core

- Severity: Medium 5.3
- Published: Jun 14, 2022
- Affected: from 7.0.0, fixed in 7.6.57; from 8.0.0, fixed in 8.7.47; from 9.0.0, fixed in 9.5.35; from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

### [CVE-2021-41113](https://cve.now/CVE-2021-41113): Cross-Site-Request-Forgery in Backend URI Handling in Typo3

- Severity: High 8.8
- Published: Oct 5, 2021
- Affected: from 11.2.0, fixed in 11.5.0.

### [CVE-2021-41114](https://cve.now/CVE-2021-41114): HTTP Host Header Injection in Request Handling in Typo3

- Severity: Medium 4.8
- Published: Oct 5, 2021
- Affected: from 11.0.0, fixed in 11.5.0.

### [CVE-2021-32768](https://cve.now/CVE-2021-32768): Cross-Site Scripting via Rich-Text Content

- Severity: Medium 6.1
- Published: Aug 10, 2021
- Affected: from 7.0.0, fixed in 7.6.53; from 8.0.0, fixed in 8.7.42; from 10.0.0, fixed in 10.4.19; from 11.0.0, fixed in 11.3.2; from 9.0.0, fixed in 9.5.29.

### [CVE-2021-32767](https://cve.now/CVE-2021-32767): Information Disclosure in User Authentication

- Severity: Medium 5.3
- Published: Jul 20, 2021
- Affected: from 7.0.0, fixed in 7.6.52; from 8.0.0, fixed in 8.7.41; from 9.0.0, fixed in 9.5.28; from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1.

### [CVE-2021-32669](https://cve.now/CVE-2021-32669): Cross-Site Scripting in Backend Grid View

- Severity: Medium 6.4
- Published: Jul 20, 2021
- Affected: from 8.0.0, fixed in 8.7.41; from 9.0.0, fixed in 9.5.28; from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1.

### [CVE-2021-32668](https://cve.now/CVE-2021-32668): Cross-Site Scripting in Query Generator & Query View

- Severity: Medium 6.4
- Published: Jul 20, 2021
- Affected: from 8.0.0, fixed in 8.7.41; from 9.0.0, fixed in 9.5.28; from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1.

### [CVE-2021-32667](https://cve.now/CVE-2021-32667): Cross-Site Scripting in Page Preview

- Severity: Medium 6.4
- Published: Jul 20, 2021
- Affected: from 9.0.0, fixed in 9.5.28; from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1.

### [CVE-2021-21359](https://cve.now/CVE-2021-21359): Denial of Service in Page Error Handling

- Severity: Medium 5.9
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2021-21370](https://cve.now/CVE-2021-21370): Cross-Site Scripting in Content Preview (CType menu)

- Severity: Medium 5.4
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2021-21339](https://cve.now/CVE-2021-21339): Cleartext storage of session identifier

- Severity: Medium 5.9
- Published: Mar 23, 2021
- Affected: from 6.2.0, fixed in 6.2.57; from 7.0.0, fixed in 7.6.51; from 8.0.0, fixed in 8.7.40; from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2021-21340](https://cve.now/CVE-2021-21340): Cross-Site Scripting in Content Preview

- Severity: Medium 5.4
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.

### [CVE-2021-21355](https://cve.now/CVE-2021-21355): Unrestricted File Upload in Form Framework

- Severity: High 8.6
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2021-21357](https://cve.now/CVE-2021-21357): Broken Access Control in Form Framework

- Severity: High 8.3
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2021-21358](https://cve.now/CVE-2021-21358): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form

- Severity: Medium 5.4
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.

### [CVE-2021-21338](https://cve.now/CVE-2021-21338): Open Redirection in Login Handling

- Severity: Medium 4.7
- Published: Mar 23, 2021
- Affected: from 6.2.0, fixed in 6.2.57; from 7.0.0, fixed in 7.6.51; from 8.0.0, fixed in 8.7.40; from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2020-26229](https://cve.now/CVE-2020-26229): XML External Entity in Dashboard Widget

- Severity: Low 3.7
- Published: Nov 23, 2020
- Affected: from 10.0.0, fixed in 10.4.10.

### [CVE-2020-26228](https://cve.now/CVE-2020-26228): Cleartext storage of session identifier

- Severity: High 8.1
- Published: Nov 23, 2020
- Affected: from 9.0.0, fixed in 9.5.23; from 10.0.0, fixed in 10.4.10; from 8.7.0, fixed in 8.7.38.

### [CVE-2020-26227](https://cve.now/CVE-2020-26227): Cross-Site Scripting in Fluid view helpers

- Severity: Medium 6.1
- Published: Nov 23, 2020
- Affected: from 9.0.0, fixed in 9.5.23; from 10.0.0, fixed in 10.4.10; from 8.7.0, fixed in 8.7.38.

### [CVE-2020-15241](https://cve.now/CVE-2020-15241): Cross-Site Scripting in TYPO3 Fluid Engine

- Severity: Medium 4.7
- Published: Oct 8, 2020
- Affected: from 8.0.0, fixed in 8.7.25; from 9.0.0, fixed in 9.5.6.

### [CVE-2020-15098](https://cve.now/CVE-2020-15098): Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS

- Severity: High 8.8
- Published: Jul 29, 2020
- Affected: from 9.0.0, fixed in 9.5.20; from 10.0.0, fixed in 10.4.6.

### [CVE-2020-15099](https://cve.now/CVE-2020-15099): Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS

- Severity: High 8.1
- Published: Jul 29, 2020
- Affected: from 9.0.0, fixed in 9.5.20; from 10.0.0, fixed in 10.4.6.

### [CVE-2020-11069](https://cve.now/CVE-2020-11069): Cross-Site Request Forgery in TYPO3 CMS

- Severity: High 8.0
- Published: May 13, 2020
- Affected: from 9.0.0, fixed in 9.5.17; from 10.0.0, fixed in 10.4.2.

### [CVE-2020-11067](https://cve.now/CVE-2020-11067): Deserialization of Untrusted Data in TYPO3 CMS

- Severity: High 8.8
- Published: May 13, 2020
- Affected: from 9.0.0, fixed in 9.5.17; from 10.0.0, fixed in 10.4.2.

### [CVE-2020-11066](https://cve.now/CVE-2020-11066): Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS

- Severity: High 8.7
- Published: May 13, 2020
- Affected: from 9.0.0, fixed in 9.5.17; from 10.0.0, fixed in 10.4.2.

### [CVE-2020-11065](https://cve.now/CVE-2020-11065): Cross-Site Scripting in TYPO3 CMS

- Severity: Medium 5.4
- Published: May 13, 2020
- Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.

### [CVE-2020-11064](https://cve.now/CVE-2020-11064): Cross-Site Scripting in TYPO3 CMS

- Severity: Medium 5.4
- Published: May 13, 2020
- Affected: from 9.0.0, fixed in 9.5.17; from 10.0.0, fixed in 10.4.2.

### [CVE-2020-11063](https://cve.now/CVE-2020-11063): Observable Response Discrepancy in TYPO3 CMS

- Severity: Low 3.7
- Published: May 13, 2020
- Affected: from 10.0.0, fixed in 10.4.2.

### [CVE-2019-19849](https://cve.now/CVE-2019-19849): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

- Severity: High 8.8
- Published: Dec 17, 2019
- Affected: from 10.0.0, fixed in 10.2.1; from 8.0.0, fixed in 8.7.30; from 9.0.0, fixed in 9.5.12.

### [CVE-2019-19850](https://cve.now/CVE-2019-19850): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

- Severity: Medium 5.5
- Published: Dec 17, 2019
- Affected: from 8.0, fixed in 8.7.30; from 9.0, fixed in 9.5.12; from 10.0, fixed in 10.2.2.

### [CVE-2019-19848](https://cve.now/CVE-2019-19848): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

- Severity: Medium 6.8
- Published: Dec 17, 2019
- Affected: from 10.0.0, fixed in 10.2.2; from 8.0.0, fixed in 8.7.30; from 9.0.0, fixed in 9.5.12.

### [CVE-2010-3673](https://cve.now/CVE-2010-3673): TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API.

- Severity: Unrated
- Published: Nov 5, 2019
- Affected: fixed in 4.2.13; from 4.3, fixed in 4.3.4; from 4.4, fixed in 4.4.1.

### [CVE-2019-12748](https://cve.now/CVE-2019-12748): TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.

- Severity: Unrated
- Published: Jul 9, 2019
- Affected: from 8.0.0, fixed in 8.7.27; from 9.0.0, fixed in 9.5.8.

### [CVE-2019-12747](https://cve.now/CVE-2019-12747): TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.

- Severity: Unrated
- Published: Jul 9, 2019
- Affected: from 8.0.0, fixed in 8.7.27; from 9.0.0, fixed in 9.5.8.

### [CVE-2019-10912](https://cve.now/CVE-2019-10912): In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain…

- Severity: Unrated
- Published: May 16, 2019
- Affected: from 9.0.0, fixed in 9.5.8.

### [CVE-2019-11832](https://cve.now/CVE-2019-11832): TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for…

- Severity: Unrated
- Published: May 9, 2019
- Affected: from 8.0.0, fixed in 8.7.25; from 9.0.0, fixed in 9.5.6.

### [CVE-2018-17960](https://cve.now/CVE-2018-17960): CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

- Severity: Unrated
- Published: Nov 14, 2018
- Affected: from 8.0.0, fixed in 8.7.21; from 9.0.0, fixed in 9.5.2.

### [CVE-2018-14041](https://cve.now/CVE-2018-14041): In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

- Severity: Unrated
- Published: Jul 13, 2018
- Affected: from 8.0.0, fixed in 8.7.23; from 9.0.0, fixed in 9.5.4.

### [CVE-2013-4320](https://cve.now/CVE-2013-4320): The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.9 and 6.1.x before 6.1.4 does not properly check permissions, which allows…

- Severity: Unrated
- Published: May 20, 2014
- Affected: from 6.0, fixed in 6.0.9; from 6.1, fixed in 6.1.4.

### [CVE-2013-7078](https://cve.now/CVE-2013-7078): Cross-site scripting (XSS) vulnerability in the errorAction method in the ActionController base class in the Extbase Framework in TYPO3…

- Severity: Unrated
- Published: Jan 19, 2014
- Affected: from 4.5.0, fixed in 4.5.31; from 4.7.0, fixed in 4.7.16; from 6.1.0, fixed in 6.1.6; from 6.0.0, fixed in 6.0.11.

### [CVE-2013-7081](https://cve.now/CVE-2013-7081): The (old) Form Content Element component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through…

- Severity: Unrated
- Published: Dec 23, 2013
- Affected: from 4.5.0, fixed in 4.5.31; from 4.7.0, fixed in 4.7.16; from 6.0.0, fixed in 6.0.11; from 6.1.0, fixed in 6.1.6.

### [CVE-2013-7080](https://cve.now/CVE-2013-7080): The creating record functionality in Extension table administration library (feuser\_adminLib.inc) in TYPO3 4.5.0 through 4.5.31, 4.7.0…

- Severity: Unrated
- Published: Dec 23, 2013
- Affected: from 4.5.0, fixed in 4.5.31; from 4.6.0, fixed in 4.7.16; from 6.0.0, fixed in 6.0.11.

### [CVE-2013-7077](https://cve.now/CVE-2013-7077): Cross-site scripting (XSS) vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7…

- Severity: Unrated
- Published: Dec 21, 2013
- Affected: from 6.0, fixed in 6.0.12; from 6.1, fixed in 6.1.7.

### [CVE-2013-1843](https://cve.now/CVE-2013-1843): Open redirect vulnerability in the Access tracking mechanism in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and…

- Severity: Unrated
- Published: Mar 20, 2013
- Affected: from 4.5.0, fixed in 4.5.24; from 4.6.0, fixed in 4.6.17; from 4.7.0, fixed in 4.7.9; from 6.0.0, fixed in 6.0.3.

### [CVE-2013-1842](https://cve.now/CVE-2013-1842): SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x…

- Severity: Unrated
- Published: Mar 20, 2013
- Affected: from 4.5.0, fixed in 4.5.24; from 4.6.0, fixed in 4.6.17; from 4.7.0, fixed in 4.7.9; from 6.0.0, fixed in 6.0.3.

### [CVE-2010-5104](https://cve.now/CVE-2010-5104): The escapeStrForLike method in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 does not properly escape input when…

- Severity: Unrated
- Published: May 21, 2012
- Affected: from 4.2.0, fixed in 4.2.16; from 4.3.0, fixed in 4.3.9; from 4.4.0, fixed in 4.4.5.

### [CVE-2009-3633](https://cve.now/CVE-2009-3633): Cross-site scripting (XSS) vulnerability in the t3lib\_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13…

- Severity: Unrated
- Published: Nov 2, 2009
- Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3alpha1, fixed in 4.3beta2.

### [CVE-2008-2717](https://cve.now/CVE-2008-2717): TYPO3 4.0.x before 4.0.9, 4.1.x before 4.1.7, and 4.2.x before 4.2.1, uses an insufficiently restrictive default fileDenyPattern for…

- Severity: Unrated
- Published: Jun 16, 2008
- Affected: from 4.0.0, fixed in 4.0.9; from 4.1.0, fixed in 4.1.7; from 4.2.0, fixed in 4.2.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/typo3/cms-core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.