{"id":"CVE-2015-8759","aliases":["EUVD-2015-8632","GHSA-j5v7-9xr5-m7gx"],"status":"published","title":"TYPO3 Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.","severity":{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00643,"percentile":0.51121,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2016-01-08T19:00:00Z","modified":"2026-06-17T00:35:11Z","fixes":[{"ecosystem":"Packagist","package":"typo3/cms","fixed_in":["6.2.16","7.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.16"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.6.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.2.16"}]}],"versions":["6.2.0","6.2.1","6.2.10","6.2.10-rc1","6.2.11","6.2.12","6.2.13","6.2.14","6.2.15","6.2.2","6.2.3","6.2.4","6.2.5","6.2.6","6.2.7","6.2.8","6.2.9"]},{"source":"osv","ecosystem":"Packagist","package":"typo3/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.6.1"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.1.0","7.2.0","7.3.0","7.3.1","7.4.0","7.5.0","7.6.0"]}],"products":[{"vendor":"typo3","product":"typo3"}],"references":[{"url":"http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012/","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/79250","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8759","tags":["advisory"]},{"url":"https://github.com/TYPO3/typo3/commit/25a1473907f0f4b2bb0147c661981940c57a4555","tags":["web"]},{"url":"https://github.com/TYPO3/typo3/commit/de1755a6dcff9b037c6d5a1fa340ba100aff054a","tags":["web"]},{"url":"https://typo3.org/security/advisory/typo3-core-sa-2015-012","tags":["web"]},{"url":"https://web.archive.org/web/20200228051548/http://www.securityfocus.com/bid/79250","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2015-12-15-2.yaml","tags":["web"]},{"url":"https://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2015-012","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j5v7-9xr5-m7gx"},{"url":"https://github.com/TYPO3/typo3","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2015-8759","description":"Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.","status":"published","published":"2016-01-08T19:00:00Z","modified":"2024-09-16T19:10:11.966Z","updated_at":"2026-11-02T14:35:40.900357Z"}],"euvd":[{"id":"EUVD-2015-8632","description":"Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.","status":"published","published":"2016-01-08T19:00:00Z","modified":"2024-09-16T19:10:11Z","updated_at":"2026-11-03T00:55:25.778976Z"}],"ghsa":[{"id":"GHSA-j5v7-9xr5-m7gx","title":"TYPO3 Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.","status":"published","published":"2022-05-17T03:59:52Z","modified":"2026-02-03T17:54:27Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:21.558748Z"}],"nvd":[{"id":"CVE-2015-8759","description":"Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.","status":"published","published":"2016-01-08T19:59:25.413Z","modified":"2026-06-17T00:35:11.177Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:15.746629Z"}],"osv":[{"id":"GHSA-j5v7-9xr5-m7gx","title":"TYPO3 Cross-site Scripting vulnerability","description":"Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.","status":"published","published":"2022-05-17T03:59:52Z","modified":"2026-02-03T18:02:41.817455Z","cvss":[{"version":"3.0","score":5.4,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:49.977351Z"}]}}