# typo3/cms (Packagist) vulnerabilities

116 known vulnerabilities (12 high, 36 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/typo3/cms

## Advisories (116)

### [CVE-2023-24814](https://cve.now/CVE-2023-24814): Persisted Cross-Site Scripting in Frontend Rendering in typo3

- Severity: High 8.8
- Published: Feb 7, 2023
- Affected: from 10.0.0, fixed in 10.4.35; from 11.0.0, fixed in 11.5.23; from 12.0.0, fixed in 12.2.0.

### [CVE-2022-23504](https://cve.now/CVE-2022-23504): TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration

- Severity: Medium 5.7
- Published: Dec 14, 2022
- Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

### [CVE-2022-23503](https://cve.now/CVE-2022-23503): TYPO3 vulnerable to Arbitrary Code Execution via Form Framework

- Severity: High 7.5
- Published: Dec 14, 2022
- Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

### [CVE-2022-23502](https://cve.now/CVE-2022-23502): TYPO3 contains Insufficient Session Expiration after Password Reset

- Severity: Medium 5.4
- Published: Dec 14, 2022
- Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

### [CVE-2022-23501](https://cve.now/CVE-2022-23501): TYPO3 vulnerable to Improper Authentication in Frontend Login

- Severity: Medium 5.9
- Published: Dec 14, 2022
- Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

### [CVE-2022-23500](https://cve.now/CVE-2022-23500): TYPO3 subject to Uncontrolled Recursion resulting in Denial of Service

- Severity: Medium 5.9
- Published: Dec 14, 2022
- Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20.

### [CVE-2022-47406](https://cve.now/CVE-2022-47406): An issue was discovered in the fe\_change\_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for…

- Severity: Medium 5.4
- Published: Dec 14, 2022
- Affected: fixed in 2.0.5; from 3.0.0, fixed in 3.0.3.

### [CVE-2022-23499](https://cve.now/CVE-2022-23499): Cross-Site Scripting Protection bypass in HTML Sanitizer

- Severity: Medium 6.1
- Published: Dec 13, 2022
- Affected: from 10.0.0, fixed in 10.4.33; from 11.0.0, fixed in 11.5.20; from 12.0.0, fixed in 12.1.1.

### [CVE-2022-36105](https://cve.now/CVE-2022-36105): User Enumeration via Response Timing in TYPO3

- Severity: Medium 5.3
- Published: Sep 13, 2022
- Affected: from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

### [CVE-2022-36106](https://cve.now/CVE-2022-36106): Missing check for expiration time of password reset token in TYPO3

- Severity: Medium 5.4
- Published: Sep 13, 2022
- Affected: from 10.4.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

### [CVE-2022-36107](https://cve.now/CVE-2022-36107): Stored Cross-Site Scripting via FileDumpController

- Severity: Medium 6.5
- Published: Sep 13, 2022
- Affected: from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

### [CVE-2022-36104](https://cve.now/CVE-2022-36104): Denial of Service via Page Error Handling in TYPO3/cms

- Severity: Medium 5.9
- Published: Sep 13, 2022
- Affected: from 11.4.0, fixed in 11.5.16.

### [CVE-2022-36108](https://cve.now/CVE-2022-36108): Cross-Site Scripting in typo3/cms-core

- Severity: Medium 6.5
- Published: Sep 13, 2022
- Affected: from 10.3.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

### [CVE-2022-36020](https://cve.now/CVE-2022-36020): Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer

- Severity: Medium 6.1
- Published: Sep 13, 2022
- Affected: from 10.0.0, fixed in 10.4.32; from 11.0.0, fixed in 11.5.16.

### [CVE-2022-31050](https://cve.now/CVE-2022-31050): Insufficient Session Expiration in TYPO3 Admin Tool

- Severity: Medium 6.0
- Published: Jun 14, 2022
- Affected: from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

### [CVE-2022-31048](https://cve.now/CVE-2022-31048): Cross-Site Scripting in Form Framework

- Severity: Medium 5.4
- Published: Jun 14, 2022
- Affected: from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

### [CVE-2022-31049](https://cve.now/CVE-2022-31049): Cross-Site Scripting in Frontend Login Mailer

- Severity: Medium 5.4
- Published: Jun 14, 2022
- Affected: from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

### [CVE-2022-31046](https://cve.now/CVE-2022-31046): Information Disclosure via Export Module in TYPO3 CMS

- Severity: Medium 4.3
- Published: Jun 14, 2022
- Affected: from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

### [CVE-2022-31047](https://cve.now/CVE-2022-31047): Insertion of Sensitive Information into Log File in typo3/cms-core

- Severity: Medium 5.3
- Published: Jun 14, 2022
- Affected: from 10.0.0, fixed in 10.4.29; from 11.0.0, fixed in 11.5.11.

### [CVE-2021-41113](https://cve.now/CVE-2021-41113): Cross-Site-Request-Forgery in Backend URI Handling in Typo3

- Severity: High 8.8
- Published: Oct 5, 2021
- Affected: from 11.2.0, fixed in 11.5.0.

### [CVE-2021-41114](https://cve.now/CVE-2021-41114): HTTP Host Header Injection in Request Handling in Typo3

- Severity: Medium 4.8
- Published: Oct 5, 2021
- Affected: from 11.0.0, fixed in 11.5.0.

### [CVE-2021-32768](https://cve.now/CVE-2021-32768): Cross-Site Scripting via Rich-Text Content

- Severity: Medium 6.1
- Published: Aug 10, 2021
- Affected: from 10.0.0, fixed in 10.4.19; from 11.0.0, fixed in 11.3.2; from 9.0.0, fixed in 9.5.29; from 8.0.0, fixed in 8.7.42; from 7.0.0, fixed in 7.6.53.

### [CVE-2021-32767](https://cve.now/CVE-2021-32767): Information Disclosure in User Authentication

- Severity: Medium 5.3
- Published: Jul 20, 2021
- Affected: from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1; from 9.0.0, fixed in 9.5.28.

### [CVE-2021-32669](https://cve.now/CVE-2021-32669): Cross-Site Scripting in Backend Grid View

- Severity: Medium 6.4
- Published: Jul 20, 2021
- Affected: from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1; from 9.0.0, fixed in 9.5.28.

### [CVE-2021-32668](https://cve.now/CVE-2021-32668): Cross-Site Scripting in Query Generator & Query View

- Severity: Medium 6.4
- Published: Jul 20, 2021
- Affected: from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1; from 9.0.0, fixed in 9.5.28.

### [CVE-2021-32667](https://cve.now/CVE-2021-32667): Cross-Site Scripting in Page Preview

- Severity: Medium 6.4
- Published: Jul 20, 2021
- Affected: from 10.0.0, fixed in 10.4.18; from 11.0.0, fixed in 11.3.1; from 9.0.0, fixed in 9.5.28.

### [CVE-2021-21359](https://cve.now/CVE-2021-21359): Denial of Service in Page Error Handling

- Severity: Medium 5.9
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2021-21370](https://cve.now/CVE-2021-21370): Cross-Site Scripting in Content Preview (CType menu)

- Severity: Medium 5.4
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2021-21339](https://cve.now/CVE-2021-21339): Cleartext storage of session identifier

- Severity: Medium 5.9
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2021-21340](https://cve.now/CVE-2021-21340): Cross-Site Scripting in Content Preview

- Severity: Medium 5.4
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.

### [CVE-2021-21355](https://cve.now/CVE-2021-21355): Unrestricted File Upload in Form Framework

- Severity: High 8.6
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2021-21357](https://cve.now/CVE-2021-21357): Broken Access Control in Form Framework

- Severity: High 8.3
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2021-21358](https://cve.now/CVE-2021-21358): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form

- Severity: Medium 5.4
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1.

### [CVE-2021-21338](https://cve.now/CVE-2021-21338): Open Redirection in Login Handling

- Severity: Medium 4.7
- Published: Mar 23, 2021
- Affected: from 10.0.0, fixed in 10.4.14; from 11.0.0, fixed in 11.1.1; from 9.0.0, fixed in 9.5.25.

### [CVE-2020-26229](https://cve.now/CVE-2020-26229): XML External Entity in Dashboard Widget

- Severity: Low 3.7
- Published: Nov 23, 2020
- Affected: from 10.0.0, fixed in 10.4.10.

### [CVE-2020-26228](https://cve.now/CVE-2020-26228): Cleartext storage of session identifier

- Severity: High 8.1
- Published: Nov 23, 2020
- Affected: from 10.0.0, fixed in 10.4.10; from 9.0.0, fixed in 9.5.23; from 8.7.0, fixed in 8.7.38.

### [CVE-2020-26227](https://cve.now/CVE-2020-26227): Cross-Site Scripting in Fluid view helpers

- Severity: Medium 6.1
- Published: Nov 23, 2020
- Affected: from 10.0.0, fixed in 10.4.10; from 9.0.0, fixed in 9.5.23; from 8.7.0, fixed in 8.7.38.

### [CVE-2020-15241](https://cve.now/CVE-2020-15241): Cross-Site Scripting in TYPO3 Fluid Engine

- Severity: Medium 4.7
- Published: Oct 8, 2020
- Affected: from 8.0.0, fixed in 8.7.25; from 9.0.0, fixed in 9.5.6.

### [CVE-2020-15098](https://cve.now/CVE-2020-15098): Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS

- Severity: High 8.8
- Published: Jul 29, 2020
- Affected: from 10.0.0, fixed in 10.4.6; from 9.0.0, fixed in 9.5.20.

### [CVE-2020-15099](https://cve.now/CVE-2020-15099): Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS

- Severity: High 8.1
- Published: Jul 29, 2020
- Affected: from 10.0.0, fixed in 10.4.6; from 9.0.0, fixed in 9.5.20.

### [CVE-2020-11069](https://cve.now/CVE-2020-11069): Cross-Site Request Forgery in TYPO3 CMS

- Severity: High 8.0
- Published: May 13, 2020
- Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.

### [CVE-2020-11067](https://cve.now/CVE-2020-11067): Deserialization of Untrusted Data in TYPO3 CMS

- Severity: High 8.8
- Published: May 13, 2020
- Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.

### [CVE-2020-11066](https://cve.now/CVE-2020-11066): Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS

- Severity: High 8.7
- Published: May 13, 2020
- Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.

### [CVE-2020-11065](https://cve.now/CVE-2020-11065): Cross-Site Scripting in TYPO3 CMS

- Severity: Medium 5.4
- Published: May 13, 2020
- Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.

### [CVE-2020-11064](https://cve.now/CVE-2020-11064): Cross-Site Scripting in TYPO3 CMS

- Severity: Medium 5.4
- Published: May 13, 2020
- Affected: from 10.0.0, fixed in 10.4.2; from 9.0.0, fixed in 9.5.17.

### [CVE-2020-11063](https://cve.now/CVE-2020-11063): Observable Response Discrepancy in TYPO3 CMS

- Severity: Low 3.7
- Published: May 13, 2020
- Affected: from 10.0.0, fixed in 10.4.2.

### [CVE-2020-8091](https://cve.now/CVE-2020-8091): svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting…

- Severity: Medium 4.8
- Published: Jan 27, 2020
- Affected: from 7.0.0, fixed in 7.2.0; from 6.2.0, fixed in 6.2.39.

### [CVE-2019-19849](https://cve.now/CVE-2019-19849): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

- Severity: High 8.8
- Published: Dec 17, 2019
- Affected: from 10.0.0, fixed in 10.2.1; from 8.0.0, fixed in 8.7.30; from 9.0.0, fixed in 9.5.12.

### [CVE-2019-19850](https://cve.now/CVE-2019-19850): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

- Severity: Medium 5.5
- Published: Dec 17, 2019
- Affected: from 8.0, fixed in 8.7.30; from 9.0, fixed in 9.5.12; from 10.0, fixed in 10.2.2.

### [CVE-2019-19848](https://cve.now/CVE-2019-19848): An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2.

- Severity: Medium 6.8
- Published: Dec 17, 2019
- Affected: from 10.0.0, fixed in 10.2.2; from 8.0.0, fixed in 8.7.30; from 9.0.0, fixed in 9.5.12.

### [CVE-2011-3583](https://cve.now/CVE-2011-3583): It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced…

- Severity: Unrated
- Published: Nov 25, 2019
- Affected: from 4.5.0, through 4.5.5.

### [CVE-2011-4904](https://cve.now/CVE-2011-4904): TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to…

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

### [CVE-2011-4903](https://cve.now/CVE-2011-4903): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary…

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

### [CVE-2011-4902](https://cve.now/CVE-2011-4902): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

### [CVE-2011-4901](https://cve.now/CVE-2011-4901): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3…

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

### [CVE-2011-4900](https://cve.now/CVE-2011-4900): TYPO3 before 4.5.4 allows Information Disclosure in the backend.

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: fixed in 4.5.4.

### [CVE-2011-4632](https://cve.now/CVE-2011-4632): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary…

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

### [CVE-2011-4630](https://cve.now/CVE-2011-4630): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary…

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: from 4.5.0, fixed in 4.5.4; from 4.4.0, fixed in 4.4.9; fixed in 4.3.12.

### [CVE-2011-4628](https://cve.now/CVE-2011-4628): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend…

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

### [CVE-2011-4627](https://cve.now/CVE-2011-4627): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.

- Severity: Unrated
- Published: Nov 6, 2019
- Affected: fixed in 4.3.12; from 4.4.0, fixed in 4.4.9; from 4.5.0, fixed in 4.5.4.

### [CVE-2019-12748](https://cve.now/CVE-2019-12748): TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.

- Severity: Unrated
- Published: Jul 9, 2019
- Affected: from 8.0.0, fixed in 8.7.27; from 9.0.0, fixed in 9.5.8.

### [CVE-2019-12747](https://cve.now/CVE-2019-12747): TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.

- Severity: Unrated
- Published: Jul 9, 2019
- Affected: from 8.0.0, fixed in 8.7.27; from 9.0.0, fixed in 9.5.8.

### [CVE-2019-10912](https://cve.now/CVE-2019-10912): In Symfony before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, it is possible to cache objects that may contain…

- Severity: Unrated
- Published: May 16, 2019
- Affected: from 9.0.0, fixed in 9.5.8.

### [CVE-2019-11832](https://cve.now/CVE-2019-11832): TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for…

- Severity: Unrated
- Published: May 9, 2019
- Affected: from 8.0.0, fixed in 8.7.25; from 9.0.0, fixed in 9.5.6.

### [CVE-2018-17960](https://cve.now/CVE-2018-17960): CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.

- Severity: Unrated
- Published: Nov 14, 2018
- Affected: from 8.0.0, fixed in 8.7.21; from 9.0.0, fixed in 9.5.2.

### [CVE-2018-14041](https://cve.now/CVE-2018-14041): In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

- Severity: Unrated
- Published: Jul 13, 2018
- Affected: from 8.0.0, fixed in 8.7.23; from 9.0.0, fixed in 9.5.4.

### [CVE-2018-6905](https://cve.now/CVE-2018-6905): The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS\['TYPO3\_CONF\_VARS'\]\['SYS'\]\['sitename'\], as demonstrated by an admin…

- Severity: Unrated
- Published: Apr 8, 2018
- Affected: fixed in 9.2.0.

### [CVE-2017-14251](https://cve.now/CVE-2017-14251): Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to…

- Severity: Unrated
- Published: Sep 11, 2017
- Affected: from 7.6.0, fixed in 7.6.22; from 8.0.0, fixed in 8.7.5.

### [CVE-2017-6370](https://cve.now/CVE-2017-6370): TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to…

- Severity: Unrated
- Published: Mar 17, 2017
- Affected: versions 7.6.15.

### [CVE-2016-4056](https://cve.now/CVE-2016-4056): Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary…

- Severity: Unrated
- Published: Jan 23, 2017
- Affected: from 6.2.0, fixed in 6.2.19.

### [CVE-2015-8760](https://cve.now/CVE-2015-8760): The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified…

- Severity: Unrated
- Published: Jan 8, 2016
- Affected: from 6.2.0, fixed in 6.2.16.

### [CVE-2015-8759](https://cve.now/CVE-2015-8759): Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote…

- Severity: Unrated
- Published: Jan 8, 2016
- Affected: from 6.2.0, fixed in 6.2.16; from 7.0.0, fixed in 7.6.1.

### [CVE-2015-8756](https://cve.now/CVE-2015-8756): Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed\_search) component in TYPO3 6.2.x before…

- Severity: Unrated
- Published: Jan 8, 2016
- Affected: from 6.2.0, fixed in 6.2.16.

### [CVE-2015-8755](https://cve.now/CVE-2015-8755): Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1…

- Severity: Unrated
- Published: Jan 8, 2016
- Affected: from 6.2, fixed in 6.2.16; from 7.0, fixed in 7.6.1.

### [CVE-2015-5956](https://cve.now/CVE-2015-5956): The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to…

- Severity: Unrated
- Published: Sep 16, 2015
- Affected: from 6.0, fixed in 6.2.15; from 7.0, fixed in 7.4.0; from 4.0, through 4.5.40.

### [CVE-2014-9509](https://cve.now/CVE-2014-9509): The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when…

- Severity: Unrated
- Published: Jan 4, 2015
- Affected: from 4.5.0, fixed in 4.5.39; from 6.2.0, fixed in 6.2.9; from 7.0.0, fixed in 7.0.2; from 4.6.0, fixed in 4.6.19; from 4.7.0, fixed in 4.7.21; from 6.0.0, fixed in 6.0.15; from 6.1.0, fixed in 6.1.13.

### [CVE-2014-9508](https://cve.now/CVE-2014-9508): The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when…

- Severity: Unrated
- Published: Jan 4, 2015
- Affected: from 4.5.0, fixed in 4.5.39; from 4.6.0, fixed in 6.2.9; from 7.0.0, fixed in 7.0.2.

### [CVE-2014-3946](https://cve.now/CVE-2014-3946): The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group…

- Severity: Unrated
- Published: Jun 3, 2014
- Affected: from 6.2.0, fixed in 6.2.3.

### [CVE-2014-3945](https://cve.now/CVE-2014-3945): The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the…

- Severity: Unrated
- Published: Jun 3, 2014
- Affected: fixed in 6.2.0.

### [CVE-2014-3944](https://cve.now/CVE-2014-3944): The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote…

- Severity: Unrated
- Published: Jun 3, 2014
- Affected: from 6.2.0, fixed in 6.2.3.

### [CVE-2014-3943](https://cve.now/CVE-2014-3943): Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19…

- Severity: Unrated
- Published: Jun 3, 2014
- Affected: from 4.5.0, fixed in 4.5.34; from 4.7.0, fixed in 4.7.19; from 6.0.0, fixed in 6.0.14; from 6.1.0, fixed in 6.1.9; from 6.2.0, fixed in 6.2.3.

### [CVE-2014-3942](https://cve.now/CVE-2014-3942): The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows…

- Severity: Unrated
- Published: Jun 3, 2014
- Affected: from 4.5.0, fixed in 4.5.34; from 4.7.0, fixed in 4.7.19; from 6.0.0, fixed in 6.0.14; from 6.1.0, fixed in 6.1.9.

### [CVE-2014-3941](https://cve.now/CVE-2014-3941): TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to…

- Severity: Unrated
- Published: Jun 3, 2014
- Affected: from 4.5.0, fixed in 4.5.34; from 4.7.0, fixed in 4.7.19; from 6.0.0, fixed in 6.0.14; from 6.1.0, fixed in 6.1.9; from 6.2.0, fixed in 6.2.3.

### [CVE-2013-4321](https://cve.now/CVE-2013-4321): The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute…

- Severity: Unrated
- Published: May 20, 2014
- Affected: from 6.0.0, fixed in 6.0.9; from 6.1.0, fixed in 6.1.4.

### [CVE-2013-4250](https://cve.now/CVE-2013-4250): The (1) file upload component and (2) File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.3 do not properly…

- Severity: Unrated
- Published: May 20, 2014
- Affected: from 6.0.0, fixed in 6.0.8; from 6.1.0, fixed in 6.1.3.

### [CVE-2012-6146](https://cve.now/CVE-2012-6146): The Backend History Module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 does not properly restrict access…

- Severity: Unrated
- Published: May 20, 2014
- Affected: from 4.5, fixed in 4.5.21; from 4.6, fixed in 4.6.14; from 4.7, fixed in 4.7.6.

### [CVE-2013-7341](https://cve.now/CVE-2013-7341): Multiple cross-site scripting (XSS) vulnerabilities in Flowplayer Flash before 3.2.17, as used in Moodle through 2.3.11, 2.4.x before…

- Severity: Unrated
- Published: Mar 22, 2014
- Affected: from 6.2.0, fixed in 6.2.14; from 7.0.0, fixed in 7.3.1.

### [CVE-2013-7075](https://cve.now/CVE-2013-7075): The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6…

- Severity: Unrated
- Published: Dec 23, 2013
- Affected: from 4.5.0, fixed in 4.5.32; from 4.7.0, fixed in 4.7.17; from 6.0.0, fixed in 6.0.12; from 6.1.0, fixed in 6.1.7.

### [CVE-2013-7073](https://cve.now/CVE-2013-7073): The Content Editing Wizards component in TYPO3 4.5.0 through 4.5.31, 4.7.0 through 4.7.16, 6.0.0 through 6.0.11, and 6.1.0 through 6.1.6…

- Severity: Unrated
- Published: Dec 23, 2013
- Affected: from 4.5.0, fixed in 4.5.32; from 4.7.0, fixed in 4.7.17; from 6.0.0, fixed in 6.0.12; from 6.1.0, fixed in 6.1.7.

### [CVE-2013-7074](https://cve.now/CVE-2013-7074): Multiple cross-site scripting (XSS) vulnerabilities in Content Editing Wizards in TYPO3 4.5.x before 4.5.32, 4.7.x before 4.7.17, 6.0.x…

- Severity: Unrated
- Published: Dec 21, 2013
- Affected: from 4.5.0, fixed in 4.5.32; from 4.7.0, fixed in 4.7.17; from 6.0.0, fixed in 6.0.12; from 6.1.0, fixed in 6.1.7.

### [CVE-2013-4701](https://cve.now/CVE-2013-4701): Auth/Yadis/XML.php in PHP OpenID Library 2.2.2 and earlier allows remote attackers to read arbitrary files, send HTTP requests to intranet…

- Severity: Unrated
- Published: Aug 21, 2013
- Affected: from 6.2.0, fixed in 6.2.6.

### [CVE-2012-6148](https://cve.now/CVE-2012-6148): Cross-site scripting (XSS) vulnerability in the function menu API in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before…

- Severity: Unrated
- Published: Jul 1, 2013
- Affected: from 4.5.0, fixed in 4.5.21; from 4.6.0, fixed in 4.6.14; from 4.7.0, fixed in 4.7.6.

### [CVE-2012-6147](https://cve.now/CVE-2012-6147): Cross-site scripting (XSS) vulnerability in the tree render API (TCA-Tree) in the Backend API in TYPO3 4.5.x before 4.5.21, 4.6.x before…

- Severity: Unrated
- Published: Jul 1, 2013
- Affected: from 4.5.0, fixed in 4.5.21; from 4.6.0, fixed in 4.6.14; from 4.7.0, fixed in 4.7.6.

### [CVE-2012-6145](https://cve.now/CVE-2012-6145): Cross-site scripting (XSS) vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before…

- Severity: Unrated
- Published: Jul 1, 2013
- Affected: from 4.5.0, fixed in 4.5.21; from 4.6.0, fixed in 4.6.14; from 4.7.0, fixed in 4.7.6.

### [CVE-2012-6144](https://cve.now/CVE-2012-6144): SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows…

- Severity: Unrated
- Published: Jul 1, 2013
- Affected: from 4.5.0, fixed in 4.5.21; from 4.6.0, fixed in 4.6.14; from 4.7.0, fixed in 4.7.6.

### [CVE-2012-3531](https://cve.now/CVE-2012-3531): Cross-site scripting (XSS) vulnerability in the Install Tool in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4…

- Severity: Unrated
- Published: Sep 5, 2012
- Affected: from 4.5, fixed in 4.5.19; from 4.6, fixed in 4.6.12; from 4.7, fixed in 4.7.4.

### [CVE-2012-3530](https://cve.now/CVE-2012-3530): Incomplete blacklist vulnerability in the t3lib\_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x…

- Severity: Unrated
- Published: Sep 5, 2012
- Affected: from 4.5, fixed in 4.5.19; from 4.6, fixed in 4.6.12; from 4.7, fixed in 4.7.4.

### [CVE-2012-3529](https://cve.now/CVE-2012-3529): The configuration module in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote…

- Severity: Unrated
- Published: Sep 5, 2012
- Affected: from 4.5, fixed in 4.5.19; from 4.6, fixed in 4.6.12; from 4.7, fixed in 4.7.4.

### [CVE-2012-3528](https://cve.now/CVE-2012-3528): Multiple cross-site scripting (XSS) vulnerabilities in the backend in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before…

- Severity: Unrated
- Published: Sep 5, 2012
- Affected: from 4.5, fixed in 4.5.19; from 4.6, fixed in 4.6.12; from 4.7, fixed in 4.7.4.

### [CVE-2012-3527](https://cve.now/CVE-2012-3527): view\_help.php in the backend help system in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote…

- Severity: Unrated
- Published: Sep 5, 2012
- Affected: from 4.5.0, fixed in 4.5.19; from 4.6.0, fixed in 4.6.12; from 4.7.0, fixed in 4.7.4.

### [CVE-2012-1608](https://cve.now/CVE-2012-1608): The t3lib\_div::RemoveXSS API method in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows remote…

- Severity: Unrated
- Published: Sep 4, 2012
- Affected: from 4.4.0, fixed in 4.4.14; from 4.5.0, fixed in 4.5.14; from 4.6.0, fixed in 4.6.7.

### [CVE-2012-1607](https://cve.now/CVE-2012-1607): The Command Line Interface (CLI) script in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0 through 4.6.6, 4.7, and 6.0 allows…

- Severity: Unrated
- Published: Sep 4, 2012
- Affected: from 4.4.0, through 4.4.13; from 4.5.0, through 4.5.13; from 4.6.0, through 4.6.6.

### [CVE-2012-1606](https://cve.now/CVE-2012-1606): Multiple cross-site scripting (XSS) vulnerabilities in the Backend component in TYPO3 4.4.0 through 4.4.13, 4.5.0 through 4.5.13, 4.6.0…

- Severity: Unrated
- Published: Sep 4, 2012
- Affected: from 4.4.0, fixed in 4.4.14; from 4.5.0, fixed in 4.5.14; from 4.6.0, fixed in 4.6.7.

### [CVE-2012-1605](https://cve.now/CVE-2012-1605): The Extbase Framework in TYPO3 4.6.x through 4.6.6, 4.7, and 6.0 unserializes untrusted data, which allows remote attackers to unserialize…

- Severity: Unrated
- Published: Sep 4, 2012
- Affected: from 4.6, fixed in 4.6.7; from 4.4.0, fixed in 4.4.14; from 4.5.0, fixed in 4.5.14.

### [CVE-2012-2112](https://cve.now/CVE-2012-2112): Cross-site scripting (XSS) vulnerability in the Exception Handler in TYPO3 4.4.x before 4.4.15, 4.5.x before 4.5.15, 4.6.x before 4.6.8…

- Severity: Unrated
- Published: Aug 27, 2012
- Affected: from 4.4, fixed in 4.4.15; from 4.5, fixed in 4.5.15; from 4.6, fixed in 4.6.8; versions 4.7.

### [CVE-2010-5099](https://cve.now/CVE-2010-5099): The fileDenyPattern functionality in the PHP file inclusion protection API in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x…

- Severity: Unrated
- Published: May 30, 2012
- Affected: from 4.2.0, fixed in 4.2.16; from 4.3.0, fixed in 4.3.9; from 4.4.0, fixed in 4.4.5.

### [CVE-2010-5103](https://cve.now/CVE-2010-5103): SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote…

- Severity: Unrated
- Published: May 21, 2012
- Affected: from 4.2.0, fixed in 4.2.16; from 4.3.0, fixed in 4.3.9; from 4.4.0, fixed in 4.4.5.

### [CVE-2010-5101](https://cve.now/CVE-2010-5101): Directory traversal vulnerability in the TypoScript setup in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows…

- Severity: Unrated
- Published: May 21, 2012
- Affected: from 4.2.0, fixed in 4.2.16; from 4.3.0, fixed in 4.3.9; from 4.4.0, fixed in 4.4.5.

### [CVE-2010-3714](https://cve.now/CVE-2010-3714): The jumpUrl (aka access tracking) implementation in tslib/class.tslib\_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x…

- Severity: Unrated
- Published: Oct 25, 2010
- Affected: from 4.2.0, fixed in 4.2.15; from 4.3.0, fixed in 4.3.7; from 4.4.0, fixed in 4.4.4.

### [CVE-2010-1153](https://cve.now/CVE-2010-1153): PHP remote file inclusion vulnerability in the autoloader in TYPO3 4.3.x before 4.3.3 allows remote attackers to execute arbitrary PHP…

- Severity: Unrated
- Published: Apr 20, 2010
- Affected: from 4.3.0, fixed in 4.3.3.

### [CVE-2009-3635](https://cve.now/CVE-2009-3635): The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows…

- Severity: Unrated
- Published: Nov 2, 2009
- Affected: through 4.0.13; from 4.1.0, fixed in 4.1.13; from 4.2.0, fixed in 4.2.10; from 4.3beta1, fixed in 4.3beta2.

### [CVE-2009-0816](https://cve.now/CVE-2009-0816): Multiple cross-site scripting (XSS) vulnerabilities in the backend user interface in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1…

- Severity: Unrated
- Published: Mar 5, 2009
- Affected: from 3.3.0; from 4.0, fixed in 4.0.12; from 4.1.0, fixed in 4.1.10; from 4.2.0, fixed in 4.2.6; versions 4.3alpha1.

### [CVE-2009-0815](https://cve.now/CVE-2009-0815): The jumpUrl mechanism in class.tslib\_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and…

- Severity: Unrated
- Published: Mar 5, 2009
- Affected: from 3.3, fixed in 4.0.12; from 4.1, fixed in 4.1.10; from 4.2, fixed in 4.2.6.

### [CVE-2009-0258](https://cve.now/CVE-2009-0258): The Indexed Search Engine (indexed\_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3…

- Severity: Unrated
- Published: Jan 22, 2009
- Affected: from 4.0.0, fixed in 4.0.10; from 4.1.0, fixed in 4.1.8; from 4.2.0, fixed in 4.2.4.

### [CVE-2009-0256](https://cve.now/CVE-2009-0256): Session fixation vulnerability in the authentication library in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3…

- Severity: Unrated
- Published: Jan 22, 2009
- Affected: from 4.0.0, fixed in 4.0.10; from 4.1.0, fixed in 4.1.8; from 4.2.0, fixed in 4.2.4.

### [CVE-2005-4875](https://cve.now/CVE-2005-4875): TYPO3 3.8.0 and earlier allows remote attackers to obtain sensitive information via a direct request to misc/phpcheck/, which invokes the…

- Severity: Unrated
- Published: May 19, 2008
- Affected: fixed in 3.8.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/typo3/cms
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.