# cve.now: Typo3

The newest entries naming Typo3 as an affected vendor (up to 200), of 198 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-120327](https://cve.now/CVE-2026-120327.md): Open Redirection in extension "Mail" (mail) (CVSS 5.3)
- [CVE-2026-120328](https://cve.now/CVE-2026-120328.md): Information Disclosure in extension "Mail" (mail) (CVSS 6.9)
- [CVE-2026-120329](https://cve.now/CVE-2026-120329.md): Broken Access Control in extension "Mail" (mail) (CVSS 5.3)
- [CVE-2026-120330](https://cve.now/CVE-2026-120330.md): Broken Access Control in extension "Mail" (mail) (CVSS 7.1)
- [CVE-2026-120331](https://cve.now/CVE-2026-120331.md): Server-Side Request Forgery in extension "Mail" (mail) (CVSS 5.3)
- [CVE-2026-120332](https://cve.now/CVE-2026-120332.md): Cross-Site Scripting in extension "Mail" (mail) (CVSS 5.1)
- [CVE-2026-120333](https://cve.now/CVE-2026-120333.md): Broken Access Control in extension "Frontend User Registration" (sf\_register) (CVSS 8.8)
- [CVE-2026-112069](https://cve.now/CVE-2026-112069.md): Broken Access Control in extension "FAL Protect" (fal\_protect) (CVSS 6.3)
- [CVE-2026-112065](https://cve.now/CVE-2026-112065.md): Missing Authorization in extension "sgalinski Cookie Consent" (sg\_cookie\_optin) (CVSS 5.3)
- [CVE-2026-112064](https://cve.now/CVE-2026-112064.md): SQL Injection in extension "sgalinski Cookie Consent" (sg\_cookie\_optin) (CVSS 7.1)
- [CVE-2026-112066](https://cve.now/CVE-2026-112066.md): Missing Authorization in extension "sgalinski Cookie Consent" (sg\_cookie\_optin) (CVSS 7.1)
- [CVE-2026-112067](https://cve.now/CVE-2026-112067.md): Captcha Bypass in extension "Accessible Form Captcha" (bw\_captcha) (CVSS 6.9)
- [CVE-2026-112068](https://cve.now/CVE-2026-112068.md): Insecure Direct Object Reference in extension "Analytics" (analytics) (CVSS 5.3)
- [CVE-2026-112237](https://cve.now/CVE-2026-112237.md): Server-Side Request Forgery in extension "Kitodo.Presentation" (dlf) (CVSS 6.9)
- [CVE-2026-112240](https://cve.now/CVE-2026-112240.md): Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid\_form) (CVSS 6.3)
- [CVE-2026-113442](https://cve.now/CVE-2026-113442.md): Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid\_form) (CVSS 5.3)
- [CVE-2026-112238](https://cve.now/CVE-2026-112238.md): SQL Injection in extension "File manager" (ameos\_filemanager) (CVSS 8.7)
- [CVE-2026-112071](https://cve.now/CVE-2026-112071.md): Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop) (CVSS 6.9)
- [CVE-2026-113468](https://cve.now/CVE-2026-113468.md): Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop) (CVSS 6.9)
- [CVE-2026-112239](https://cve.now/CVE-2026-112239.md): Broken Access Control in extension "TYPO3 AI Integration Extension" (ns\_t3ai) (CVSS 7.2)
- [CVE-2026-113459](https://cve.now/CVE-2026-113459.md): Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns\_t3ai) (CVSS 7.1)
- [CVE-2026-112070](https://cve.now/CVE-2026-112070.md): Broken Access Control in extension "Analytics" (analytics) (CVSS 5.3)
- [CVE-2026-109162](https://cve.now/CVE-2026-109162.md): TYPO3 CMS - Security Misconfiguration in Form Framework (CVSS 6.3)
- [CVE-2023-50462](https://cve.now/CVE-2023-50462.md): An issue was discovered in the content\_consent (aka Content Consent) extension through 2.0.1 for TYPO3. (CVSS 5.3)
- [CVE-2023-50461](https://cve.now/CVE-2023-50461.md): An issue was discovered in the direct\_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. (CVSS 8.8)
- [CVE-2023-50460](https://cve.now/CVE-2023-50460.md): An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. (CVSS 5.4)
- [CVE-2023-50459](https://cve.now/CVE-2023-50459.md): An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. (CVSS 5.4)
- [CVE-2023-45023](https://cve.now/CVE-2023-45023.md): The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component (CVSS 4.2)
- [CVE-2026-77132](https://cve.now/CVE-2026-77132.md): TYPO3 CMS - Information Disclosure via Backend Localization Wizard (CVSS 5.3)
- [CVE-2026-85400](https://cve.now/CVE-2026-85400.md): TYPO3 CMS - Missing Authorization in lowlevel commands (CVSS 7.5)
- [CVE-2026-56092](https://cve.now/CVE-2026-56092.md): Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) (CVSS 7.6)
- [CVE-2026-56093](https://cve.now/CVE-2026-56093.md): Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) (CVSS 6.3)
- [CVE-2026-56094](https://cve.now/CVE-2026-56094.md): Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) (CVSS 6.3)
- [CVE-2026-56095](https://cve.now/CVE-2026-56095.md): Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) (CVSS 7.7)
- [CVE-2026-56096](https://cve.now/CVE-2026-56096.md): Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr) (CVSS 6.3)
- [CVE-2026-77127](https://cve.now/CVE-2026-77127.md): Information Disclosure in extension "Modules" (modules) (CVSS 6.0)
- [CVE-2026-77128](https://cve.now/CVE-2026-77128.md): Broken Access Control in extension "Event management and registration" (sf\_event\_mgt) (CVSS 6.3)
- [CVE-2026-77129](https://cve.now/CVE-2026-77129.md): Server-Side Template Injection in extension "Event management and registration" (sf\_event\_mgt) (CVSS 7.7)
- [CVE-2026-77130](https://cve.now/CVE-2026-77130.md): Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy) (CVSS 5.3)
- [CVE-2026-77131](https://cve.now/CVE-2026-77131.md): Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy) (CVSS 5.3)
- [CVE-2026-77133](https://cve.now/CVE-2026-77133.md): Broken Access Control in extension "femanager" (femanager) (CVSS 6.0)
- [CVE-2026-77134](https://cve.now/CVE-2026-77134.md): Broken Access Control in extension "femanager" (femanager) (CVSS 8.3)
- [CVE-2026-77135](https://cve.now/CVE-2026-77135.md): Information Disclosure in extension "femanager" (femanager) (CVSS 8.2)
- [CVE-2026-77136](https://cve.now/CVE-2026-77136.md): Server-Side Template Injection in extension "powermail" (powermail) (CVSS 9.5)
- [CVE-2026-77137](https://cve.now/CVE-2026-77137.md): SQL Injection in extension "Forms Export" (frp\_form\_answers) (CVSS 7.7)
- [CVE-2026-77138](https://cve.now/CVE-2026-77138.md): Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer\_powermail) (CVSS 9.3)
- [CVE-2026-77139](https://cve.now/CVE-2026-77139.md): Path Traversal in extension "Mask" (mask) (CVSS 6.0)
- [CVE-2026-77140](https://cve.now/CVE-2026-77140.md): Broken Access Control in extension "Telephone Directory" (telephonedirectory) (CVSS 8.7)
- [CVE-2026-77141](https://cve.now/CVE-2026-77141.md): Broken Access Control in extension "Club Directory" (clubdirectory) (CVSS 8.8)
- [CVE-2026-77142](https://cve.now/CVE-2026-77142.md): Broken Access Control in extension "Industry Directory" (yellowpages2) (CVSS 8.8)
- [CVE-2026-77143](https://cve.now/CVE-2026-77143.md): Broken Access Control in extension "Forum" (pforum) (CVSS 8.8)
- [CVE-2026-77144](https://cve.now/CVE-2026-77144.md): Broken Access Control in extension "Events 2" (events2) (CVSS 7.1)
- [CVE-2026-77145](https://cve.now/CVE-2026-77145.md): Broken Access Control in extension "Events 2" (events2) (CVSS 7.1)
- [CVE-2026-77146](https://cve.now/CVE-2026-77146.md): Broken Access Control in extension "femanager" (femanager) (CVSS 8.3)
- [CVE-2026-19418](https://cve.now/CVE-2026-19418.md): TYPO3 CMS - Broken Access Control in Backend and Install Tool (CVSS 7.3)
- [CVE-2026-15305](https://cve.now/CVE-2026-15305.md): TYPO3 CMS - Unrestricted File Upload in Form Framework (CVSS 6.3)
- [CVE-2026-49742](https://cve.now/CVE-2026-49742.md): TYPO3 CMS - Broken Access Control in Media Module (CVSS 7.1)
- [CVE-2026-49741](https://cve.now/CVE-2026-49741.md): TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework (CVSS 8.7)
- [CVE-2026-49740](https://cve.now/CVE-2026-49740.md): TYPO3 CMS - Insecure Deserialization in Core API (CVSS 6.3)
- [CVE-2026-49738](https://cve.now/CVE-2026-49738.md): TYPO3 CMS - Broken Access Control in File Abstraction Layer (CVSS 2.1)
- [CVE-2026-47352](https://cve.now/CVE-2026-47352.md): TYPO3 CMS - Broken Access Control in Backend API (CVSS 5.3)
- [CVE-2026-47351](https://cve.now/CVE-2026-47351.md): TYPO3 CMS - Broken Access Control in Clipboard (CVSS 5.3)
- [CVE-2026-47350](https://cve.now/CVE-2026-47350.md): TYPO3 CMS - Broken Access Control in DataHandler (CVSS 5.3)
- [CVE-2026-47349](https://cve.now/CVE-2026-47349.md): TYPO3 CMS - Broken Access Control in Recycler (CVSS 5.3)
- [CVE-2026-47348](https://cve.now/CVE-2026-47348.md): TYPO3 CMS - Cross-Site Scripting in Indexed Search (CVSS 5.1)
- [CVE-2026-47347](https://cve.now/CVE-2026-47347.md): TYPO3 CMS - Open Redirect in Core Utilities (CVSS 5.3)
- [CVE-2026-47346](https://cve.now/CVE-2026-47346.md): TYPO3 CMS - Broken Access Control in Form Framework (CVSS 7.6)
- [CVE-2026-47343](https://cve.now/CVE-2026-47343.md): TYPO3 CMS - Destructive Actions on File Mount Folders (CVSS 7.2)
- [CVE-2026-11607](https://cve.now/CVE-2026-11607.md): TYPO3 CMS - Broken Access Control in Form Framework (CVSS 7.6)
- [CVE-2026-47345](https://cve.now/CVE-2026-47345.md): TYPO3 HTML Sanitizer allows Cross-Site Scripting (CVSS 5.1)
- [CVE-2026-47344](https://cve.now/CVE-2026-47344.md): TYPO3 HTML Sanitizer allows Cross-Site Scripting (CVSS 2.1)
- [CVE-2026-46725](https://cve.now/CVE-2026-46725.md): Remote Code Execution in extension "Content Element Selector" (ceselector) (CVSS 9.2)
- [CVE-2026-8827](https://cve.now/CVE-2026-8827.md): SQL Injection in extension "Address List" (tt\_address) (CVSS 8.2)
- [CVE-2026-46724](https://cve.now/CVE-2026-46724.md): Path Traversal in extension "Faceted Search" (ke\_search) (CVSS 5.9)
- [CVE-2026-46723](https://cve.now/CVE-2026-46723.md): Information Disclosure in extension "Faceted Search" (ke\_search) (CVSS 5.9)
- [CVE-2026-46722](https://cve.now/CVE-2026-46722.md): XML External Entity Injection in extension "Faceted Search" (ke\_search) (CVSS 5.9)
- [CVE-2026-8726](https://cve.now/CVE-2026-8726.md): SQL Injection in extension "News system" (news) (CVSS 8.2)
- [CVE-2026-46721](https://cve.now/CVE-2026-46721.md): Broken Access Control in extension "Frontend User Registration" (sf\_register) (CVSS 6.9)
- [CVE-2026-8727](https://cve.now/CVE-2026-8727.md): Remote Code Execution in extension "Site Crawler" (crawler) (CVSS 7.1)
- [CVE-2026-6553](https://cve.now/CVE-2026-6553.md): TYPO3 CMS Stores Cleartext Password in User Settings Module (CVSS 7.3)
- [CVE-2026-4208](https://cve.now/CVE-2026-4208.md): Authentication Bypass in extension "E-Mail MFA Provider" (mfa\_email) (CVSS 7.7)
- [CVE-2026-4202](https://cve.now/CVE-2026-4202.md): Broken Access Control in extension "Redirect Tab" (CVSS 2.3)
- [CVE-2026-1323](https://cve.now/CVE-2026-1323.md): Insecure Deserialization in extension "Mailqueue" (mailqueue) (CVSS 5.2)
- [CVE-2026-0895](https://cve.now/CVE-2026-0895.md): Insecure Deserialization in extension "Mailqueue" (mailqueue) (CVSS 5.2)
- [CVE-2026-0859](https://cve.now/CVE-2026-0859.md): TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool (CVSS 5.2)
- [CVE-2025-59022](https://cve.now/CVE-2025-59022.md): TYPO3 CMS Allows Broken Access Control in Recycler Module (CVSS 7.1)
- [CVE-2025-59021](https://cve.now/CVE-2025-59021.md): TYPO3 CMS Allows Broken Access Control in Redirects Module (CVSS 5.3)
- [CVE-2025-59020](https://cve.now/CVE-2025-59020.md): TYPO3 CMS Allows Broken Access Control in Edit Document Controller (CVSS 5.3)
- [CVE-2025-12998](https://cve.now/CVE-2025-12998.md): Broken Authentication in extension “Modules” (modules) (CVSS 8.2)
- [CVE-2025-10316](https://cve.now/CVE-2025-10316.md): Cross-Site Scripting in extension "Form to Database" (form\_to\_database) (CVSS 2.3)
- [CVE-2025-59019](https://cve.now/CVE-2025-59019.md): Information Disclosure via CSV Download (CVSS 5.3)
- [CVE-2025-59018](https://cve.now/CVE-2025-59018.md): Information Disclosure in Workspaces Module (CVSS 7.1)
- [CVE-2025-59017](https://cve.now/CVE-2025-59017.md): Broken Access Control in Backend AJAX Routes (CVSS 5.3)
- [CVE-2025-59016](https://cve.now/CVE-2025-59016.md): Information Disclosure via File Abstraction Layer (CVSS 5.3)
- [CVE-2025-59015](https://cve.now/CVE-2025-59015.md): Insufficient Entropy in Password Generation (CVSS 6.3)
- [CVE-2025-59014](https://cve.now/CVE-2025-59014.md): Denial of Service in TYPO3 Bookmark Toolbar (CVSS 5.1)
- [CVE-2025-59013](https://cve.now/CVE-2025-59013.md): Open Redirect in TYPO3 CMS (CVSS 5.3)
- [CVE-2025-9573](https://cve.now/CVE-2025-9573.md): Command Injection in extension "TYPO3 Backup Plus" (ns\_backup) (CVSS 8.6)
- [CVE-2025-7900](https://cve.now/CVE-2025-7900.md): Insecure Direct Object Reference in extension "femanager" (femanager) (CVSS 5.3)
- [CVE-2025-7899](https://cve.now/CVE-2025-7899.md): Insecure Direct Object Reference in extension "powermail" (powermail) (CVSS 6.0)
- [CVE-2025-48207](https://cve.now/CVE-2025-48207.md): The reint\_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference. (CVSS 8.6)
- [CVE-2025-48206](https://cve.now/CVE-2025-48206.md): The ns\_backup extension through 13.0.0 for TYPO3 allows XSS. (CVSS 6.1)
- [CVE-2025-48205](https://cve.now/CVE-2025-48205.md): The sr\_feuser\_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference. (CVSS 8.6)
- [CVE-2025-48204](https://cve.now/CVE-2025-48204.md): The ns\_backup extension through 13.0.0 for TYPO3 allows command injection. (CVSS 6.8)
- [CVE-2025-48203](https://cve.now/CVE-2025-48203.md): The cs\_seo extension through 9.2.0 for TYPO3 allows XSS. (CVSS 6.4)
- [CVE-2025-48202](https://cve.now/CVE-2025-48202.md): The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference. (CVSS 5.3)
- [CVE-2025-48201](https://cve.now/CVE-2025-48201.md): The ns\_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location. (CVSS 8.6)
- [CVE-2025-48200](https://cve.now/CVE-2025-48200.md): The sr\_feuser\_register extension through 12.4.8 for TYPO3 allows Remote Code Execution. (CVSS 10.0)
- [CVE-2025-47941](https://cve.now/CVE-2025-47941.md): TYPO3 Has Broken Authentication in Backend MFA (CVSS 7.2)
- [CVE-2025-47940](https://cve.now/CVE-2025-47940.md): TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer (CVSS 7.2)
- [CVE-2025-47939](https://cve.now/CVE-2025-47939.md): TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer (CVSS 5.4)
- [CVE-2025-47938](https://cve.now/CVE-2025-47938.md): TYPO3 Vulnerable to Unverified Password Change for Backend Users (CVSS 3.8)
- [CVE-2025-47937](https://cve.now/CVE-2025-47937.md): TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling (CVSS 3.7)
- [CVE-2025-47936](https://cve.now/CVE-2025-47936.md): TYPO3 Vulnerable to Server Side Request Forgery via Webhooks (CVSS 3.3)
- [CVE-2025-24856](https://cve.now/CVE-2025-24856.md): An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3. (CVSS 4.2)
- [CVE-2024-55892](https://cve.now/CVE-2024-55892.md): Potential Open Redirect via Parsing Differences in TYPO3 (CVSS 4.8)
- [CVE-2024-55893](https://cve.now/CVE-2024-55893.md): TYPO3 Cross-Site Request Forgery in Log Module (CVSS 4.3)
- [CVE-2024-55894](https://cve.now/CVE-2024-55894.md): TYPO3 Cross-Site Request Forgery in Backend User Module (CVSS 4.3)
- [CVE-2024-55920](https://cve.now/CVE-2024-55920.md): Cross-Site Request Forgery in Dashboard Module in TYPO3 (CVSS 4.3)
- [CVE-2024-55921](https://cve.now/CVE-2024-55921.md): Cross-Site Request Forgery in Extension Manager Module in TYPO3 (CVSS 7.5)
- [CVE-2024-55922](https://cve.now/CVE-2024-55922.md): Cross-Site Request Forgery in Form Framework Module in TYPO3 (CVSS 5.4)
- [CVE-2024-55923](https://cve.now/CVE-2024-55923.md): Cross-Site Request Forgery in Indexed Search Module in TYPO3 (CVSS 4.3)
- [CVE-2024-55924](https://cve.now/CVE-2024-55924.md): Cross-Site Request Forgery in Scheduler Module in TYPO3 (CVSS 8.0)
- [CVE-2024-55945](https://cve.now/CVE-2024-55945.md): Cross-Site Request Forgery in DB Check Module in TYPO3 (CVSS 4.3)
- [CVE-2024-55891](https://cve.now/CVE-2024-55891.md): Information Disclosure via Exception Handling/Logger in TYPO3 (CVSS 3.1)
- [CVE-2024-47780](https://cve.now/CVE-2024-47780.md): Information Disclosure in TYPO3 Page Tree (CVSS 3.1)
- [CVE-2024-34358](https://cve.now/CVE-2024-34358.md): TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController (CVSS 5.3)
- [CVE-2024-34357](https://cve.now/CVE-2024-34357.md): TYPO3 vulnerable to Cross-Site Scripting in ShowImageController (CVSS 5.4)
- [CVE-2024-34356](https://cve.now/CVE-2024-34356.md): TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module (CVSS 5.4)
- [CVE-2024-34355](https://cve.now/CVE-2024-34355.md): TYPO3 vulnerable to an HTML Injection in the History Module (CVSS 3.5)
- [CVE-2024-25118](https://cve.now/CVE-2024-25118.md): Information Disclosure of Hashed Passwords in TYPO3 Backend Forms (CVSS 4.3)
- [CVE-2024-25119](https://cve.now/CVE-2024-25119.md): Information Disclosure of Encryption Key in TYPO3 Install Tool (CVSS 4.9)
- [CVE-2024-25120](https://cve.now/CVE-2024-25120.md): Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3 (CVSS 4.3)
- [CVE-2024-25121](https://cve.now/CVE-2024-25121.md): Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3 (CVSS 7.1)
- [CVE-2023-47125](https://cve.now/CVE-2023-47125.md): By-passing Cross-Site Scripting Protection in HTML Sanitizer (CVSS 4.7)
- [CVE-2023-47126](https://cve.now/CVE-2023-47126.md): Information Disclosure in Install Tool in typo3/cms-install (CVSS 3.7)
- [CVE-2023-47127](https://cve.now/CVE-2023-47127.md): Weak Authentication in Session Handling in typo3/cms-core (CVSS 4.2)
- [CVE-2023-38500](https://cve.now/CVE-2023-38500.md): By-passing Cross-Site Scripting Protection in HTML Sanitizer (CVSS 4.7)
- [CVE-2023-38499](https://cve.now/CVE-2023-38499.md): typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution (CVSS 3.7)
- [CVE-2023-37905](https://cve.now/CVE-2023-37905.md): Cross-site Scripting (XSS) in Source Mode of Editor in ckeditor-wordcount-plugin (CVSS 6.1)
- [CVE-2023-24814](https://cve.now/CVE-2023-24814.md): Persisted Cross-Site Scripting in Frontend Rendering in typo3 (CVSS 8.8)
- [CVE-2022-23504](https://cve.now/CVE-2022-23504.md): TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration (CVSS 5.7)
- [CVE-2022-23503](https://cve.now/CVE-2022-23503.md): TYPO3 vulnerable to Arbitrary Code Execution via Form Framework (CVSS 7.5)
- [CVE-2022-23502](https://cve.now/CVE-2022-23502.md): TYPO3 contains Insufficient Session Expiration after Password Reset (CVSS 5.4)
- [CVE-2022-23501](https://cve.now/CVE-2022-23501.md): TYPO3 vulnerable to Improper Authentication in Frontend Login (CVSS 5.9)
- [CVE-2022-23500](https://cve.now/CVE-2022-23500.md): TYPO3 subject to Uncontrolled Recursion resulting in Denial of Service (CVSS 5.9)
- [CVE-2022-23499](https://cve.now/CVE-2022-23499.md): Cross-Site Scripting Protection bypass in HTML Sanitizer (CVSS 6.1)
- [CVE-2022-36105](https://cve.now/CVE-2022-36105.md): User Enumeration via Response Timing in TYPO3 (CVSS 5.3)
- [CVE-2022-36106](https://cve.now/CVE-2022-36106.md): Missing check for expiration time of password reset token in TYPO3 (CVSS 5.4)
- [CVE-2022-36107](https://cve.now/CVE-2022-36107.md): Stored Cross-Site Scripting via FileDumpController (CVSS 6.5)
- [CVE-2022-36104](https://cve.now/CVE-2022-36104.md): Denial of Service via Page Error Handling in TYPO3/cms (CVSS 5.9)
- [CVE-2022-36108](https://cve.now/CVE-2022-36108.md): Cross-Site Scripting in typo3/cms-core (CVSS 6.5)
- [CVE-2022-36020](https://cve.now/CVE-2022-36020.md): Bypass of Cross-Site Scripting Protection in typo3/html-sanitizer (CVSS 6.1)
- [CVE-2022-31050](https://cve.now/CVE-2022-31050.md): Insufficient Session Expiration in TYPO3 Admin Tool (CVSS 6.0)
- [CVE-2022-31048](https://cve.now/CVE-2022-31048.md): Cross-Site Scripting in Form Framework (CVSS 5.4)
- [CVE-2022-31049](https://cve.now/CVE-2022-31049.md): Cross-Site Scripting in Frontend Login Mailer (CVSS 5.4)
- [CVE-2022-31046](https://cve.now/CVE-2022-31046.md): Information Disclosure via Export Module in TYPO3 CMS (CVSS 4.3)
- [CVE-2022-31047](https://cve.now/CVE-2022-31047.md): Insertion of Sensitive Information into Log File in typo3/cms-core (CVSS 5.3)
- [CVE-2021-41113](https://cve.now/CVE-2021-41113.md): Cross-Site-Request-Forgery in Backend URI Handling in Typo3 (CVSS 8.8)
- [CVE-2021-41114](https://cve.now/CVE-2021-41114.md): HTTP Host Header Injection in Request Handling in Typo3 (CVSS 4.8)
- [CVE-2021-32768](https://cve.now/CVE-2021-32768.md): Cross-Site Scripting via Rich-Text Content (CVSS 6.1)
- [CVE-2021-32767](https://cve.now/CVE-2021-32767.md): Information Disclosure in User Authentication (CVSS 5.3)
- [CVE-2021-32669](https://cve.now/CVE-2021-32669.md): Cross-Site Scripting in Backend Grid View (CVSS 6.4)
- [CVE-2021-32668](https://cve.now/CVE-2021-32668.md): Cross-Site Scripting in Query Generator & Query View (CVSS 6.4)
- [CVE-2021-32667](https://cve.now/CVE-2021-32667.md): Cross-Site Scripting in Page Preview (CVSS 6.4)
- [CVE-2021-21359](https://cve.now/CVE-2021-21359.md): Denial of Service in Page Error Handling (CVSS 5.9)
- [CVE-2021-21370](https://cve.now/CVE-2021-21370.md): Cross-Site Scripting in Content Preview (CType menu) (CVSS 5.4)
- [CVE-2021-21339](https://cve.now/CVE-2021-21339.md): Cleartext storage of session identifier (CVSS 5.9)
- [CVE-2021-21340](https://cve.now/CVE-2021-21340.md): Cross-Site Scripting in Content Preview (CVSS 5.4)
- [CVE-2021-21355](https://cve.now/CVE-2021-21355.md): Unrestricted File Upload in Form Framework (CVSS 8.6)
- [CVE-2021-21357](https://cve.now/CVE-2021-21357.md): Broken Access Control in Form Framework (CVSS 8.3)
- [CVE-2021-21358](https://cve.now/CVE-2021-21358.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form (CVSS 5.4)
- [CVE-2021-21338](https://cve.now/CVE-2021-21338.md): Open Redirection in Login Handling (CVSS 4.7)
- [CVE-2020-26229](https://cve.now/CVE-2020-26229.md): XML External Entity in Dashboard Widget (CVSS 3.7)
- [CVE-2020-26228](https://cve.now/CVE-2020-26228.md): Cleartext storage of session identifier (CVSS 8.1)
- [CVE-2020-26227](https://cve.now/CVE-2020-26227.md): Cross-Site Scripting in Fluid view helpers (CVSS 6.1)
- [CVE-2020-26216](https://cve.now/CVE-2020-26216.md): Cross-Site Scripting in TYPO3 Fluid (CVSS 8.0)
- [CVE-2020-15241](https://cve.now/CVE-2020-15241.md): Cross-Site Scripting in TYPO3 Fluid Engine (CVSS 4.7)
- [CVE-2020-15098](https://cve.now/CVE-2020-15098.md): Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS (CVSS 8.8)
- [CVE-2020-15099](https://cve.now/CVE-2020-15099.md): Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS (CVSS 8.1)
- [CVE-2020-11069](https://cve.now/CVE-2020-11069.md): Cross-Site Request Forgery in TYPO3 CMS (CVSS 8.0)
- [CVE-2020-11067](https://cve.now/CVE-2020-11067.md): Deserialization of Untrusted Data in TYPO3 CMS (CVSS 8.8)
- [CVE-2020-11066](https://cve.now/CVE-2020-11066.md): Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS (CVSS 8.7)
- [CVE-2020-11065](https://cve.now/CVE-2020-11065.md): Cross-Site Scripting in TYPO3 CMS (CVSS 5.4)
- [CVE-2020-11064](https://cve.now/CVE-2020-11064.md): Cross-Site Scripting in TYPO3 CMS (CVSS 5.4)
- [CVE-2020-11063](https://cve.now/CVE-2020-11063.md): Observable Response Discrepancy in TYPO3 CMS (CVSS 3.7)
- [CVE-2011-4904](https://cve.now/CVE-2011-4904.md): TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve (no CVSS)
- [CVE-2011-4903](https://cve.now/CVE-2011-4903.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2011-4902](https://cve.now/CVE-2011-4902.md): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver. (no CVSS)
- [CVE-2011-4901](https://cve.now/CVE-2011-4901.md): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 data (no CVSS)
- [CVE-2011-4900](https://cve.now/CVE-2011-4900.md): TYPO3 before 4.5.4 allows Information Disclosure in the backend. (no CVSS)
- [CVE-2011-4632](https://cve.now/CVE-2011-4632.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2011-4631](https://cve.now/CVE-2011-4631.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2011-4630](https://cve.now/CVE-2011-4630.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2011-4629](https://cve.now/CVE-2011-4629.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2011-4628](https://cve.now/CVE-2011-4628.md): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend t (no CVSS)
- [CVE-2011-4627](https://cve.now/CVE-2011-4627.md): TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend. (no CVSS)
- [CVE-2011-4626](https://cve.now/CVE-2011-4626.md): Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary we (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/typo3
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.