TYPO3 vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
456 matching records
- High8.8TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.Check if you run itEPSS 1.19%Nov 4, 2019
- Medium6.1TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend.Check if you run itEPSS 0.90%Nov 1, 2019
- Medium5.4TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend.Check if you run itEPSS 0.78%Nov 1, 2019
- Medium6.1TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS.Check if you run itEPSS 0.69%Jul 9, 2019
- High8.8TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data.Check if you run itEPSS 1.53%Jul 9, 2019
- High7.5TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonst…Check if you run itEPSS 3.92%May 9, 2019
- Medium4.8The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name…Check if you run itEPSS 2.17%Apr 8, 2018
- Medium5.4Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote auth…Check if you run itEPSS 1.28%Oct 20, 2017
- High8.8Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allo…Check if you run itEPSS 2.31%Sep 11, 2017
- Medium5.3TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext inform…Check if you run itEPSS 0.99%Mar 17, 2017
- High8.1Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a craf…Check if you run itEPSS 3.38%Jan 23, 2017
- Medium6.1Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the m…Check if you run itEPSS 1.08%Jan 23, 2017
- Medium6.1The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."Check if you run itEPSS 1.43%Jan 8, 2016
- Medium5.4Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbit…Check if you run itEPSS 0.64%Jan 8, 2016
- Medium5.4Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated edi…Check if you run itEPSS 1.14%Jan 8, 2016
- Medium6.1Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers to inject arbitrary web scr…Check if you run itEPSS 1.43%Jan 8, 2016
- Medium5.4Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed_search) component in TYPO3 6.2.x before 6.2.16 allows remote authenti…Check if you run itEPSS 0.80%Jan 8, 2016
- Medium5.4Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated edit…Check if you run itEPSS 1.14%Jan 8, 2016
- Low3.5The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct…Check if you run itEPSS 2.01%Sep 16, 2015
- Low2.6The rsaauth extension in TYPO3 4.3.0 through 4.3.14, 4.4.0 through 4.4.15, 4.5.0 through 4.5.39, and 4.6.0 through 4.6.18, when configured for the frontend, allows rem…Check if you run itEPSS 1.52%Feb 23, 2015
- High7.5The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or…Check if you run itEPSS 1.50%Jan 4, 2015
- Medium4.3The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using…Check if you run itEPSS 1.72%Jan 4, 2015
- Low3.5Cross-site scripting (XSS) vulnerability in the layout wizard in the Grid Elements (gridelements) extension before 1.5.1 and 2.0.x before 2.0.3 for TYPO3 allows remote…Check if you run itEPSS 0.95%Jun 4, 2014
- Medium4.3Cross-site scripting (XSS) vulnerability in the HTML export wizard in the backend module in the powermail extension before 1.6.11 for TYPO3 allows remote attackers to…Check if you run itEPSS 1.16%Jun 4, 2014
- Medium4.0The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authen…Check if you run itEPSS 1.12%Jun 3, 2014