Skip to contentTypo3 vulnerabilities
Newest
- typo3 extension "powermail"Insecure Direct Object Reference in extension "powermail" (powermail)CVE-2025-7899Fix available6.0 Medium
- typo3 reint downloadmanager extensionreint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object ReferenceCVE-2025-48207Fix available8.6 High
- nitsantech ns-backup, typo3 ns backup extension +1 moreThe Backup Plus extension for TYPO3 (ns_backup) allows XSSCVE-2025-48206Fix available6.1 Medium
- typo3 sr feuser register extensionThe Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object ReferenceCVE-2025-48205Fix available8.6 High
- typo3 ns backup extensionThe Backup Plus extension for TYPO3 (ns_backup) allows command injectionsCVE-2025-48204Fix available6.8 Medium
- typo3 cs seo extension[clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerabilityCVE-2025-48203Fix available6.4 Medium
- typo3 femanager extensionThe femanager TYPO3 extension allows Insecure Direct Object ReferenceCVE-2025-48202Fix available5.3 Medium
- typo3 ns backup extensionThe Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource LocationCVE-2025-48201Fix available8.6 High
- typo3 sr feuser register extensionThe Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code ExecutionCVE-2025-48200Fix available10.0 Critical
- typo3TYPO3 Has Broken Authentication in Backend MFACVE-2025-47941Fix available7.2 High
- typo3TYPO3 CMS Vulnerable to Privilege Escalation to System MaintainerCVE-2025-47940Fix available7.2 High
- typo3TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction LayerCVE-2025-47939Fix available5.4 Medium
- typo3TYPO3 Vulnerable to Unverified Password Change for Backend UsersCVE-2025-47938Fix available3.8 Low
- typo3TYPO3 Vulnerable to Information Disclosure via DBAL Restriction HandlingCVE-2025-47937Fix available3.7 Low
- typo3TYPO3 Vulnerable to Server Side Request Forgery via WebhooksCVE-2025-47936Fix available3.3 Low
- typo3 oidcTYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)CVE-2025-24856Fix available4.2 Medium
- typo3Cross-Site Request Forgery in DB Check Module in TYPO3CVE-2024-55945Fix available4.3 Medium
- typo3Cross-Site Request Forgery in Scheduler Module in TYPO3CVE-2024-55924Fix available8.0 High
- typo3Cross-Site Request Forgery in Indexed Search Module in TYPO3CVE-2024-55923Fix available4.3 Medium
- typo3Cross-Site Request Forgery in Form Framework Module in TYPO3CVE-2024-55922Fix available5.4 Medium
- typo3Cross-Site Request Forgery in Extension Manager Module in TYPO3CVE-2024-55921Fix available7.5 High
- typo3Cross-Site Request Forgery in Dashboard Module in TYPO3CVE-2024-55920Fix available4.3 Medium
- typo3TYPO3 Cross-Site Request Forgery in Backend User ModuleCVE-2024-55894Fix available4.3 Medium
- typo3TYPO3 Cross-Site Request Forgery in Log ModuleCVE-2024-55893Fix available4.3 Medium
- typo3Potential Open Redirect via Parsing Differences in TYPO3CVE-2024-55892Fix available4.8 Medium
- typo3Information Disclosure via Exception Handling/Logger in TYPO3CVE-2024-55891Fix available3.1 Low
- typo3Denial of Service in TYPO3 Bookmark ToolbarCVE-2024-34537Fix available4.9 Medium
- typo3Information Disclosure in TYPO3 Page TreeCVE-2024-47780Fix available3.1 Low
- in2code powermail, typo3 +1 morePowermail TYPO3 extension Broken Access Control in the OutputControllerCVE-2024-45233Fix available9.8 Critical
- in2code powermail, typo3 +1 more"powermail" (powermail) Insecure Direct Object Reference (IDOR)CVE-2024-45232Fix available5.3 Medium
- typo3 events2events2 TYPO3 extension insecure direct object reference (IDOR) vulnerabilityCVE-2024-38874Fix available5.4 Medium
- typo3 friendlycaptcha officialFriendlyCaptcha Plugin for TYPO3 Captcha Check BypassCVE-2024-38873Fix available5.3 Medium
- typo3TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageControllerCVE-2024-34358Fix available5.3 Medium
- typo3TYPO3 vulnerable to Cross-Site Scripting in ShowImageControllerCVE-2024-34357Fix available5.4 Medium
- typo3TYPO3 vulnerable to Cross-Site Scripting in the Form Manager ModuleCVE-2024-34356Fix available5.4 Medium
- typo3TYPO3 vulnerable to an HTML Injection in the History ModuleCVE-2024-34355Fix available3.5 Low
- matthiask html-sanitizerhtml-sanitizer allows arbitrary HTML present after sanitization because of unicode normalizationCVE-2024-34078Fix available6.1 Medium
- typo3TYPO3 Install Tool vulnerable to Code ExecutionCVE-2024-22188Fix available7.2 High
- typo3Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3CVE-2024-25121Fix available7.1 High
- typo3Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3CVE-2024-25120Fix available4.3 Medium
- typo3Information Disclosure of Encryption Key in TYPO3 Install ToolCVE-2024-25119Fix available4.9 Medium
- typo3Information Disclosure of Hashed Passwords in TYPO3 Backend FormsCVE-2024-25118Fix available4.3 Medium
- typo3Path Traversal in TYPO3 File Abstraction Layer StoragesCVE-2023-30451Fix available4.9 Medium
- typo3 content consentInsecure Direct Object Reference in extension "Content Consent" (content_consent)CVE-2023-50462Fix available5.3 Medium
- typo3 femanagerBroken Access Control in extension "femanager"CVE-2023-50459Fix available5.4 Medium
- typo3 direct mailConfiguration Injection in extension "Direct Mail" (direct_mail)CVE-2023-50461Fix available8.8 High
- typo3 html-sanitizer, html sanitizer, typo3 +2 moreBy-passing Cross-Site Scripting Protection in HTML SanitizerCVE-2023-47125Public exploitFix available4.7 Medium
- typo3Information Disclosure in Install Tool in typo3/cms-installCVE-2023-47126Fix available3.7 Low
- typo3Weak Authentication in Session Handling in typo3/cms-coreCVE-2023-47127Fix available4.2 Medium
- typo3 femanagerTYPO3 extension femanager Broken Access Control vulnerabilityCVE-2023-45023Fix available4.2 Medium
- Show moreLoading…