CVE-2012-3530
Typo3 API XSS Vulnerability
CVE-2012-3530 is a medium vulnerability (CVSS 4.3) in Typo3, published August 30, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.65%, the 76th percentile. Fixed in typo3/cms 4.5.19.
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
Exploit likelihood
What each source reports
NVD Score used
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
- Record
CVE-2012-3530- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
- Record
CVE-2012-3530- Updated
- 2026-11-02
EUVDEUVD-2022-3285 No score
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
- Record
EUVD-2022-3285- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-94c2-g68f-9r98 No score
Typo3 API XSS Vulnerability
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
- Record
GHSA-94c2-g68f-9r98- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-94c2-g68f-9r98 No score
Typo3 API XSS Vulnerability
Incomplete blacklist vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.5.x before 4.5.19, 4.6.x before 4.6.12 and 4.7.x before 4.7.4 allows remote attackers to conduct cross-site scripting (XSS) attacks via certain HTML5 JavaScript events.
- Record
GHSA-94c2-g68f-9r98- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
typo3/cmsPackagist |
4.5 up to 4.5.19 | 4.5.19 |
typo3/cmsPackagist |
4.6 up to 4.6.12 | 4.6.12 |
typo3/cmsPackagist |
4.7 up to 4.7.4 | 4.7.4 |
typo3-srcDebian:6.0 |
before 4.3.9+dfsg1-1+squeeze5, plus listed versions 4.3.9+dfsg1-14.3.9+dfsg1-1+squeeze14.3.9+dfsg1-1+squeeze24.3.9+dfsg1-1+squeeze34.3.9+dfsg1-1+squeeze4 |
4.3.9+dfsg1-1+squeeze5 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-004
exchange.xforce.ibmcloud.com/vulnerabilities/77794
debian.org/security/2012/dsa-2537
openwall.com/lists/oss-security/2012/08/22/8
osvdb.org/84772
secunia.com/advisories/50287
nvd.nist.gov/vuln/detail/CVE-2012-3530
github.com/advisories/GHSA-94c2-g68f-9r98