Every CVESearch/Get API key

GHSA-4459-qrcc-vfcf

TYPO3 Cross-Site Scripting in Form Framework

6.1 MediumFix available

Failing to properly encode user input, frontend forms handled by the form framework (system extension “form”) are vulnerable to cross-site scripting.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

What each source reports

GitHub Advisories Score used6.1

TYPO3 Cross-Site Scripting in Form Framework

Failing to properly encode user input, frontend forms handled by the form framework (system extension “form”) are vulnerable to cross-site scripting.

Record
GHSA-4459-qrcc-vfcf
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV6.1

TYPO3 Cross-Site Scripting in Form Framework

Failing to properly encode user input, frontend forms handled by the form framework (system extension “form”) are vulnerable to cross-site scripting.

Record
GHSA-4459-qrcc-vfcf
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
typo3/cms-core
Packagist
8.5.0 up to 8.7.23
8.7.23
typo3/cms-core
Packagist
9.0.0 up to 9.5.4
9.5.4
typo3/cms-core
Packagist
8.5.0 up to 8.7.23, plus listed versions
v8.7.10v8.7.11v8.7.12v8.7.13v8.7.14
Show 11 moreShow less
v8.7.15v8.7.16v8.7.17v8.7.18v8.7.19v8.7.20v8.7.21v8.7.22v8.7.7v8.7.8v8.7.9
8.7.23
typo3/cms-core
Packagist
9.0.0 up to 9.5.4, plus listed versions
v9.0.0v9.1.0v9.2.0v9.2.1v9.3.0
Show 8 moreShow less
v9.3.1v9.3.2v9.3.3v9.4.0v9.5.0v9.5.1v9.5.2v9.5.3
9.5.4

History

History
RecordedChangedSources
first indexedGitHub Advisories, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

GHSA-4459-qrcc-vfcf is a medium vulnerability (CVSS 6.1) in typo3/cms-core, published May 30, 2024. No source lists public exploit code. Fixed in typo3/cms-core 8.7.23.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open