Typo3 vulnerabilities
198 CVEs and advisories name Typo3 as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-59019Information Disclosure via CSV Download
- CVE-2025-59018Information Disclosure in Workspaces Module
- CVE-2025-59017Broken Access Control in Backend AJAX Routes
- CVE-2025-59016Information Disclosure via File Abstraction Layer
- CVE-2025-59015Insufficient Entropy in Password Generation
- CVE-2025-59014Denial of Service in TYPO3 Bookmark Toolbar
- CVE-2025-59013Open Redirect in TYPO3 CMS
- CVE-2025-9573Command Injection in extension "TYPO3 Backup Plus" (ns_backup)
- CVE-2025-7900Insecure Direct Object Reference in extension "femanager" (femanager)
- CVE-2025-7899Insecure Direct Object Reference in extension "powermail" (powermail)
- CVE-2025-48207The reint_downloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference.
- CVE-2025-48206The ns_backup extension through 13.0.0 for TYPO3 allows XSS.
- CVE-2025-48205The sr_feuser_register extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference.
- CVE-2025-48204The ns_backup extension through 13.0.0 for TYPO3 allows command injection.
- CVE-2025-48203The cs_seo extension through 9.2.0 for TYPO3 allows XSS.
- CVE-2025-48202The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference.
- CVE-2025-48201The ns_backup extension through 13.0.0 for TYPO3 has a Predictable Resource Location.
- CVE-2025-48200The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.
- CVE-2025-47941TYPO3 Has Broken Authentication in Backend MFA
- CVE-2025-47940TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainer
- CVE-2025-47939TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer
- CVE-2025-47938TYPO3 Vulnerable to Unverified Password Change for Backend Users
- CVE-2025-47937TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling
- CVE-2025-47936TYPO3 Vulnerable to Server Side Request Forgery via Webhooks
- CVE-2025-24856An issue was discovered in the oidc (aka OpenID Connect Authentication) extension before 4.0.0 for TYPO3.
- CVE-2024-55892Potential Open Redirect via Parsing Differences in TYPO3
- CVE-2024-55893TYPO3 Cross-Site Request Forgery in Log Module
- CVE-2024-55894TYPO3 Cross-Site Request Forgery in Backend User Module
- CVE-2024-55920Cross-Site Request Forgery in Dashboard Module in TYPO3
- CVE-2024-55921Cross-Site Request Forgery in Extension Manager Module in TYPO3