Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

typo3/cms-form

8 known vulnerabilities (5 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 5 high, 3 medium
Registry
Packagist

Advisories 8

  • CVE-2026-15305Medium 6.3

    TYPO3 CMS - Unrestricted File Upload in Form Framework

    Affected: from 14.2.0, fixed in 14.3.5; from 14.2.0, fixed in 14.3.5.

  • TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework

    Affected: from 14.0.0, fixed in 14.3.3; from 14.0.0, fixed in 14.3.3.

  • TYPO3 CMS - Broken Access Control in Form Framework

    Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

  • TYPO3 CMS - Broken Access Control in Form Framework

    Affected: fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3; fixed in 10.4.57; from 11.0.0, fixed in 11.5.51; from 12.0.0, fixed in 12.4.46; from 13.0.0, fixed in 13.4.31; from 14.0.0, fixed in 14.3.3.

  • CVE-2024-55922Medium 5.4

    Cross-Site Request Forgery in Form Framework Module in TYPO3

    Affected: from 10.0.0, fixed in 10.4.48; from 11.0.0, fixed in 11.5.42; from 12.0.0, fixed in 12.4.25; from 13.0.0, fixed in 13.4.3.

  • Unrestricted File Upload in Form Framework

    Affected: from 8.0.0, fixed in 8.7.40; from 9.0.0, fixed in 9.5.25; from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.

  • Broken Access Control in Form Framework

    Affected: from 8.0.0, fixed in 8.7.40; from 9.0.0, fixed in 9.5.25; from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.

  • CVE-2021-21358Medium 5.4

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form

    Affected: from 10.2.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.