typo3/cms vulnerabilities
TYPO3 CMS is a free open source Content Management Framework initially created by Kasper Skaarhoj and licensed under GNU/GPL.
- Registry
- Composer
- Latest
- 14.3.10
- License
- GPL-2.0-or-later
188 known advisories
The latest version, 14.3.10, is affected by 1 of them.
Security advisories for typo3/cms
TYPO3 Denial of Service in Online Media Asset Handling
- Affected
- >=7.0.0 <7.6.32 · >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2
- Fixed in
- 7.6.32, 8.7.21, 9.5.2
TYPO3 Information Disclosure in Install Tool
- Affected
- >=7.0.0 <7.6.32 · >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2
- Fixed in
- 7.6.32, 8.7.21, 9.5.2
TYPO3 Security Misconfiguration in Install Tool Cookie
- Affected
- >=7.0.0 <7.6.32 · >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2
- Fixed in
- 7.6.32, 8.7.21, 9.5.2
TYPO3 Cross-Site Scripting in Frontend User Login
- Affected
- >=7.0.0 <7.6.32 · >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2
- Fixed in
- 7.6.32, 8.7.21, 9.5.2
TYPO3 Cross-Site Scripting in Backend Modal Component
- Affected
- >=7.0.0 <7.6.32 · >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2
- Fixed in
- 7.6.32, 8.7.21, 9.5.2
TYPO3 Cross-Site Scripting in Online Media Asset Rendering
- Affected
- >=7.0.0 <7.6.32 · >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2
- Fixed in
- 7.6.32, 8.7.21, 9.5.2
TYPO3 Arbitrary Code Execution via File List Module
- Affected
- >=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
- Fixed in
- 8.7.23, 9.5.4
TYPO3 Denial of Service in Frontend Record Registration
- Affected
- >=7.0.0 <7.6.32 · >=8.0.0 <8.7.21
- Fixed in
- 7.6.32, 8.7.21
TYPO3 Information Disclosure of Installed Extensions
- Affected
- >=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
- Fixed in
- 8.7.23, 9.5.4
TYPO3 Cross-Site Scripting in Form Framework validation handling
- Affected
- >=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12, 10.2.1
TYPO3 Cross-Site Scripting in Form Framework
- Affected
- >=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
- Fixed in
- 8.7.23, 9.5.4
TYPO3 Security Misconfiguration for Backend User Accounts
- Affected
- >=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
- Fixed in
- 8.7.23, 9.5.4
TYPO3 Cross-Site Scripting in Link Handling
- Affected
- >=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12, 10.2.1
TYPO3 Broken Access Control in Localization Handling
- Affected
- >=8.0.0 <8.7.23
- Fixed in
- 8.7.23
TYPO3 Cross-Site Scripting in Filelist Module
- Affected
- >=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12, 10.2.1
TYPO3 Cross-Site Scripting in Fluid ViewHelpers
- Affected
- >=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
- Fixed in
- 8.7.23, 9.5.4
TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling
- Affected
- >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12
Typo3 Cross-Site Scripting in Language Pack Handling
- Affected
- >=9.0.0 <9.5.4
- Fixed in
- 9.5.4
Typo3 Broken Access Control in Import Module
- Affected
- >=9.0.0 <9.5.8
- Fixed in
- 9.5.8
Typo3 Information Disclosure in Page Tree
- Affected
- >=9.0.0 <9.5.6
- Fixed in
- 9.5.6
Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API
- Affected
- >=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
- Fixed in
- 8.7.27, 9.5.8
Typo3 Security Misconfiguration in Frontend Session Handling
- Affected
- >=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
- Fixed in
- 8.7.27, 9.5.8
Typo3 Security Misconfiguration in User Session Handling
- Affected
- >=8.0.0 <8.7.25 · >=9.0.0 <9.5.6
- Fixed in
- 8.7.25, 9.5.6
Typo3 Information Disclosure in Backend User Interface
- Affected
- >=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
- Fixed in
- 8.7.27, 9.5.8
Typo3 Information Disclosure in User Authentication
- Affected
- >=9.0.0 <9.5.6
- Fixed in
- 9.5.6
Cross-Site Scripting in TYPO3 CMS Backend
- Affected
- >=8.0.0 <8.7.5
- Fixed in
- 8.7.5
Cross-Site Scripting in TYPO3 CMS
- Affected
- >=7.6.0 <7.6.16 · >=8.0.0 <8.6.1
- Fixed in
- 7.6.16, 8.6.1
Insecure Unserialize in TYPO3 Backend
- Affected
- >=6.2.0 <6.2.29 · >=7.6.0 <7.6.13 · >=8.0.0 <8.4.1
- Fixed in
- 6.2.29, 7.6.13, 8.4.1
Cache Flooding in TYPO3 Frontend
- Affected
- >=6.2.0 <6.2.27 · >=7.6.0 <7.6.11 · >=8.0.0 <8.3.1
- Fixed in
- 6.2.27, 7.6.11, 8.3.1
Authentication Bypass in TYPO3 Frontend
- Affected
- >=8.2.0 <8.6.1
- Fixed in
- 8.6.1
Authentication Bypass in TYPO3 CMS
- Affected
- >=7.0.0 <7.6.30 · >=8.0.0 <8.7.17 · >=9.0.0 <9.3.2
- Fixed in
- 7.6.30, 8.7.17, 9.3.2
Information Disclosure in TYPO3 CMS
- Affected
- >=7.6.0 <7.6.22 · >=8.0.0 <8.7.5
- Fixed in
- 7.6.22, 8.7.5
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS
- Affected
- >=7.0.0 <7.6.30 · >=8.0.0 <8.7.17 · >=9.0.0 <9.3.2
- Fixed in
- 7.6.30, 8.7.17, 9.3.2
Information Disclosure in TYPO3 CMS
- Affected
- >=7.6.0 <7.6.22 · >=8.0.0 <8.7.5
- Fixed in
- 7.6.22, 8.7.5
Privilege Escalation & SQL Injection in TYPO3 CMS
- Affected
- >=8.5.0 <8.7.17 · >=9.0.0 <9.3.2
- Fixed in
- 8.7.17, 9.3.2
TYPO3 Remote Code Execution in third party library swiftmailer
- Affected
- >=6.2.0 <6.2.30 · >=7.6.0 <7.6.15 · >=8.0.0 <8.5.1
- Fixed in
- 6.2.30, 7.6.15, 8.5.1
Arbitrary Code Execution in TYPO3 CMS
- Affected
- >=7.6.0 <7.6.22 · >=8.0.0 <8.7.5
- Fixed in
- 7.6.22, 8.7.5
Insecure Deserialization in TYPO3 CMS
- Affected
- >=8.5.0 <8.7.17 · >=9.0.0 <9.3.2
- Fixed in
- 8.7.17, 9.3.2
Cross-Site Scripting (XSS) vulnerability in typolinks
- Affected
- >=6.2.0 <6.2.26 · >=7.6.0 <7.6.10 · >=8.0.0 <8.2.1
- Fixed in
- 6.2.26, 7.6.10, 8.2.1
Cross-Site Scripting (XSS) in TYPO3 Backend
- Affected
- >=6.2.0 <6.2.27 · >=7.6.0 <7.6.11 · >=8.0.0 <8.3.1
- Fixed in
- 6.2.27, 7.6.11, 8.3.1
Cross-Site Scripting in third party library mso/idna-convert
- Affected
- >=7.6.0 <7.6.10 · >=8.0.0 <8.2.1
- Fixed in
- 7.6.10, 8.2.1
Information Disclosure in TYPO3 Backend
- Affected
- >=6.2.0 <6.2.26 · >=7.6.0 <7.6.10 · >=8.0.0 <8.2.1
- Fixed in
- 6.2.26, 7.6.10, 8.2.1
SQL Injection in TYPO3 Frontend Login
- Affected
- >=6.2.0 <6.2.26 · >=7.6.0 <7.6.10
- Fixed in
- 6.2.26, 7.6.10
Missing Access Check in TYPO3 CMS
- Affected
- >=6.2.0 <6.2.25 · >=7.6.0 <7.6.8 · >=8.0.0 <8.1.1
- Fixed in
- 6.2.25, 7.6.8, 8.1.1
Insecure Unserialize in TYPO3 Import/Export
- Affected
- >=6.2.0 <6.2.26 · >=7.6.0 <7.6.10 · >=8.0.0 <8.2.1
- Fixed in
- 6.2.26, 7.6.10, 8.2.1
Cross-Site Scripting in TYPO3 Backend
- Affected
- >=6.2.0 <6.2.26 · >=7.6.0 <7.6.10 · >=8.0.0 <8.2.1
- Fixed in
- 6.2.26, 7.6.10, 8.2.1
Privilege Escalation in TYPO3 CMS
- Affected
- >=6.2.0 <6.2.20 · >=7.6.0 <7.6.5 · >=8.0.0 <8.0.1
- Fixed in
- 6.2.20, 7.6.5, 8.0.1
Cross-Site Scripting in TYPO3 Backend
- Affected
- >=6.2.0 <6.2.20 · >=7.6.0 <7.6.5 · >=8.0.0 <8.0.1
- Fixed in
- 6.2.20, 7.6.5, 8.0.1
Authentication Bypass in TYPO3 CMS
- Affected
- >=6.2.0 <6.2.20 · >=7.6.0 <7.6.5 · >=8.0.0 <8.0.1
- Fixed in
- 6.2.20, 7.6.5, 8.0.1
Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search
- Affected
- >=6.2.0 <6.2.19 · >=7.6.0 <7.6.4
- Fixed in
- 6.2.19, 7.6.4
Typo3 Arbitrary File Disclosure in Form Component
- Affected
- >=6.2.0 <6.2.20
- Fixed in
- 6.2.20
Cross-Site Scripting (XSS) in TYPO3 component CSS styled content
- Affected
- >=6.2.0 <6.2.19 · >=7.6.0 <7.6.4
- Fixed in
- 6.2.19, 7.6.4
XML External Entity (XXE) Processing in TYPO3 Core
- Affected
- >=6.2.0 <6.2.19 · >=7.6.0 <7.6.4
- Fixed in
- 6.2.19, 7.6.4
Cross-Site Scripting (XSS) in TYPO3 component Backend
- Affected
- >=6.2.0 <6.2.19
- Fixed in
- 6.2.19
TYPO3 Cross-Site Scripting (XSS) in form component
- Affected
- >=6.2.0 <6.2.18
- Fixed in
- 6.2.18
TYPO3 Cross-Site Scripting in legacy form component
- Affected
- >=6.2.0 <6.2.18
- Fixed in
- 6.2.18
TYPO3 Cross-Site Scripting in link validator component
- Affected
- >=6.2.0 <6.2.18 · >=7.6.0 <7.6.3
- Fixed in
- 6.2.18, 7.6.3
TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend
- Affected
- >=6.2.0 <6.2.16 · >=7.0.0 <7.6.1
- Fixed in
- 6.2.16, 7.6.1
TYPO3 SQL Injection in dbal
- Affected
- >=6.2.0 <6.2.18
- Fixed in
- 6.2.18
Cross-Site Scripting in TYPO3 component Indexed Search
- Affected
- >=6.2.0 <6.2.16
- Fixed in
- 6.2.16
TYPO3 is susceptible to Cross-Site Flashing
- Affected
- >=6.2.0 <6.2.16
- Fixed in
- 6.2.16
Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend
- Affected
- >=6.2.0 <6.2.16 · >=7.0.0 <7.6.1
- Fixed in
- 6.2.16, 7.6.1
TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure
- Affected
- >=6.2.0 <6.2.15 · >=7.0.0 <7.4.0
- Fixed in
- 6.2.15, 7.4.0
TYPO3 Brute Force Protection Bypass in backend login
- Affected
- >=6.2.0 <6.2.14 · >=7.0.0 <7.3.1
- Fixed in
- 6.2.14, 7.3.1
TYPO3 Information Disclosure Vulnerability Exploitable by Editors
- Affected
- >=6.2.0 <6.2.14 · >=7.0.0 <7.3.1
- Fixed in
- 6.2.14, 7.3.1
TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors
- Affected
- >=6.2.0 <6.2.14 · >=7.0.0 <7.3.1
- Fixed in
- 6.2.14, 7.3.1
TYPO3 frontend login vulnerable to Session Fixation
- Affected
- >=6.2.0 <6.2.14 · >=7.0.0 <7.3.1
- Fixed in
- 6.2.14, 7.3.1
TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts
- Affected
- >=6.2.0 <6.2.14 · >=7.0.0 <7.3.1
- Fixed in
- 6.2.14, 7.3.1
TYPO3 possible cache poisoning on the homepage when anchors are used
- Affected
- >=6.2.0 <6.2.9 · >=7.0.0 <7.0.2
- Fixed in
- 6.2.9, 7.0.2
ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting
- Affected
- >=6.2.0 <6.2.3 · >=6.1.0 <6.1.9 · >=4.7.0 <4.7.19 · >=4.5.0 <4.5.34
- Fixed in
- 4.5.34, 4.7.19, 6.1.9, 6.2.3
TYPO3 Arbitrary Shell Execution in Swiftmailer library
- Affected
- >=6.2.0 <6.2.6 · >=6.1.0 <6.1.12 · >=4.7.0 <4.7.20 · >=4.5.0 <4.5.37
- Fixed in
- 4.5.37, 4.7.20, 6.1.12, 6.2.6
Path Traversal in TYPO3 Core
- Affected
- >=6.2.0 <6.2.29 · >=7.6.0 <7.6.13 · >=8.0.0 <8.4.1
- Fixed in
- 6.2.29, 7.6.13, 8.4.1
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering
- Affected
- >=10.0.0 <10.4.35 · >=11.0.0 <11.5.23 · >=12.0.0 <12.2.0
- Fixed in
- 10.4.35, 11.5.23, 12.2.0
TYPO3 vulnerable to Insufficient Session Expiration
- Affected
- <2.0.5 · >=3.0.0 <3.0.3
- Fixed in
- 2.0.5, 3.0.3
TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration
- Affected
- >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
- Fixed in
- 10.4.33, 11.5.20, 12.1.1
TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework
- Affected
- >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
- Fixed in
- 10.4.33, 11.5.20, 12.1.1
TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset
- Affected
- >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
- Fixed in
- 10.4.33, 11.5.20, 12.1.1
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login
- Affected
- >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
- Fixed in
- 10.4.33, 11.5.20, 12.1.1
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
- Affected
- >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20
- Fixed in
- 10.4.33, 11.5.20
TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting
- Affected
- >=10.0.0 <10.4.33 · >=11.0.0 <11.5.20 · >=12.0.0 <12.1.1
- Fixed in
- 10.4.33, 11.5.20, 12.1.1
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection
- Affected
- >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
- Fixed in
- 10.4.32, 11.5.16
TYPO3 CMS vulnerable to Denial of Service in Page Error Handling
- Affected
- >=11.4.0 <11.5.16
- Fixed in
- 11.5.16
TYPO3 CMS vulnerable to User Enumeration via Response Timing
- Affected
- >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
- Fixed in
- 10.4.32, 11.5.16
TYPO3 CMS missing check for expiration time of password reset token for backend users
- Affected
- >=10.4.0 <10.4.32 · >=11.0.0 <11.5.16
- Fixed in
- 10.4.32, 11.5.16
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController
- Affected
- >=10.0.0 <10.4.32 · >=11.0.0 <11.5.16
- Fixed in
- 10.4.32, 11.5.16
TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper
- Affected
- >=10.3.0 <10.4.32 · >=11.0.0 <11.5.16
- Fixed in
- 10.4.32, 11.5.16
Insufficient Session Expiration in TYPO3's Admin Tool
- Affected
- >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
- Fixed in
- 10.4.29, 11.5.11
Cross-Site Scripting in TYPO3's Frontend Login Mailer
- Affected
- >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
- Fixed in
- 10.4.29, 11.5.11
Cross-Site Scripting in TYPO3's Form Framework
- Affected
- >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
- Fixed in
- 10.4.29, 11.5.11
Insertion of Sensitive Information into Log File in typo3/cms-core
- Affected
- >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
- Fixed in
- 10.4.29, 11.5.11
Information Disclosure via Export Module
- Affected
- >=10.0.0 <10.4.29 · >=11.0.0 <11.5.11
- Fixed in
- 10.4.29, 11.5.11
TYPO3 Vulnerable to Insecure Deserialization
- Affected
- >=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
- Fixed in
- 8.7.27, 9.5.8
Typo3 Cross-Site Scripting in Link Handling
- Affected
- >=8.0.0 <8.7.27 · >=9.0.0 <9.5.8
- Fixed in
- 8.7.27, 9.5.8
TYPO3 Image Processing susceptible to Code Execution
- Affected
- >=8.0.0 <8.7.25 · >=9.0.0 <9.5.6
- Fixed in
- 8.7.25, 9.5.6
Typo3 Cross-Site Scripting in Flash component (ELTS)
- Affected
- >=7.0.0 <7.2.0 · >=6.2.0 <6.2.39
- Fixed in
- 6.2.39, 7.2.0
TYPO3 SQL Injection in low-level Query Generator
- Affected
- >=8.0 <8.7.30 · >=9.0 <9.5.12 · >=10.0 <10.2.2
- Fixed in
- 8.7.30, 9.5.12, 10.2.2
TYPO3 Insecure Deserialization in Query Generator & Query View
- Affected
- >=10.0.0 <10.2.1 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12, 10.2.1
TYPO3 Directory Traversal on ZIP extraction
- Affected
- >=10.0.0 <10.2.2 · >=8.0.0 <8.7.30 · >=9.0.0 <9.5.12
- Fixed in
- 8.7.30, 9.5.12, 10.2.2
TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism
- Affected
- >=4.2.0 <4.2.15 · >=4.3.0 <4.3.7 · >=4.4.0 <4.4.4
- Fixed in
- 4.2.15, 4.3.7, 4.4.4
TYPO3 allows remote attackers to obtain the database name via a direct request
- Affected
- >=4.4.0 <=4.4.13 · >=4.5.0 <=4.5.13 · >=4.6.0 <=4.6.6
- Fixed in
- No fix released
Typo3 API XSS Vulnerabilities
- Affected
- >=4.4.0 <4.4.14 · >=4.5.0 <4.5.14 · >=4.6.0 <4.6.7
- Fixed in
- 4.4.14, 4.5.14, 4.6.7
Typo3 Backend XSS Vulnerabilities
- Affected
- >=4.4.0 <4.4.14 · >=4.5.0 <4.5.14 · >=4.6.0 <4.6.7
- Fixed in
- 4.4.14, 4.5.14, 4.6.7
Typo3 Extbase Framework Unsafe Deserialization
- Affected
- >=4.6 <4.6.7 · >=4.4.0 <4.4.14 · >=4.5.0 <4.5.14
- Fixed in
- 4.4.14, 4.5.14, 4.6.7
TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component
- Affected
- >=4.5.0 <4.5.32 · >=4.7.0 <4.7.17 · >=6.0.0 <6.0.12 · >=6.1.0 <6.1.7
- Fixed in
- 4.5.32, 4.7.17, 6.0.12, 6.1.7
TYPO3 vulnerable to remote authenticated arbitrary code execution
- Affected
- >=6.0.0 <6.0.9 · >=6.1.0 <6.1.4
- Fixed in
- 6.0.9, 6.1.4
Typo3 Backend History Module Vulnerable to XSS
- Affected
- >=4.5 <4.5.21 · >=4.6 <4.6.14 · >=4.7 <4.7.6
- Fixed in
- 4.5.21, 4.6.14, 4.7.6
TYPO3 doesn't properly check file extensions
- Affected
- >=6.0.0 <6.0.8 · >=6.1.0 <6.1.3
- Fixed in
- 6.0.8, 6.1.3
TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash
- Affected
- <6.2.0
- Fixed in
- 6.2.0
TYPO3 Improper Session Invalidation
- Affected
- >=6.2.0 <6.2.3
- Fixed in
- 6.2.3
Typo3 Information Disclosure
- Affected
- >=6.2.0 <6.2.3
- Fixed in
- 6.2.3
Typo3 Vulnerable to Cache Poisoning
- Affected
- >=4.5.0 <4.5.39 · >=6.2.0 <6.2.9 · >=7.0.0 <7.0.2 · >=4.6.0 <4.6.19 · >=4.7.0 <4.7.21 · >=6.0.0 <6.0.15 · >=6.1.0 <6.1.13
- Fixed in
- 4.5.39, 4.6.19, 4.7.21, 6.0.15, 6.1.13, 6.2.9, 7.0.2
TYPO3 Cross-site Scripting vulnerability
- Affected
- >=6.2.0 <6.2.16 · >=7.0.0 <7.6.1
- Fixed in
- 6.2.16, 7.6.1
TYPO3 CMS indexed search Cross-site Scripting vulnerability
- Affected
- >=6.2.0 <6.2.16
- Fixed in
- 6.2.16
TYPO3 allows remote attackers to embed Flash videos from external domain
- Affected
- >=6.2.0 <6.2.16
- Fixed in
- 6.2.16
Typo3 XSS Vulnerability
- Affected
- >=6.2 <6.2.16 · >=7.0 <7.6.1
- Fixed in
- 6.2.16, 7.6.1
PHP OpenID Library Denial of Service vulnerability
- Affected
- >=6.2.0 <6.2.6
- Fixed in
- 6.2.6
TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component
- Affected
- >=4.5.0 <4.5.32 · >=4.7.0 <4.7.17 · >=6.0.0 <6.0.12 · >=6.1.0 <6.1.7
- Fixed in
- 4.5.32, 4.7.17, 6.0.12, 6.1.7
Typo3 Open Redirect In Frontend Rendering
- Affected
- >=4.5.0 <4.5.39 · >=4.6.0 <6.2.9 · >=7.0.0 <7.0.2
- Fixed in
- 4.5.39, 6.2.9, 7.0.2
TYPO3 Backend component Cross-site scripting (XSS) vulnerability
- Affected
- >=6.2.0 <6.2.19
- Fixed in
- 6.2.19
TYPO3 Path Traversal vulnerability
- Affected
- >=4.2.0 <4.2.16 · >=4.3.0 <4.3.9 · >=4.4.0 <4.4.5
- Fixed in
- 4.2.16, 4.3.9, 4.4.5
TYPO3 Directory Traversal vulnerability
- Affected
- >=4.2.0 <4.2.16 · >=4.3.0 <4.3.9 · >=4.4.0 <4.4.5
- Fixed in
- 4.2.16, 4.3.9, 4.4.5
TYPO3 SQL Injection vulnerability
- Affected
- >=4.2.0 <4.2.16 · >=4.3.0 <4.3.9 · >=4.4.0 <4.4.5
- Fixed in
- 4.2.16, 4.3.9, 4.4.5
Typo3 Exception Handler XSS
- Affected
- >=4.4 <4.4.15 · >=4.5 <4.5.15 · >=4.6 <4.6.8 · 4.7
- Fixed in
- 4.4.15, 4.5.15, 4.6.8
TYPO3 allows remote authenticated backend users to unserialize arbitrary objects
- Affected
- >=4.5.0 <4.5.19 · >=4.6.0 <4.6.12 · >=4.7.0 <4.7.4
- Fixed in
- 4.5.19, 4.6.12, 4.7.4
Typo3 Backend XSS Vulnerability
- Affected
- >=4.5 <4.5.19 · >=4.6 <4.6.12 · >=4.7 <4.7.4
- Fixed in
- 4.5.19, 4.6.12, 4.7.4
Typo3 Backend Configuration XSS Vulnerability
- Affected
- >=4.5 <4.5.19 · >=4.6 <4.6.12 · >=4.7 <4.7.4
- Fixed in
- 4.5.19, 4.6.12, 4.7.4
Typo3 API XSS Vulnerability
- Affected
- >=4.5 <4.5.19 · >=4.6 <4.6.12 · >=4.7 <4.7.4
- Fixed in
- 4.5.19, 4.6.12, 4.7.4
Typo3 Install Tool XSS Vulnerability
- Affected
- >=4.5 <4.5.19 · >=4.6 <4.6.12 · >=4.7 <4.7.4
- Fixed in
- 4.5.19, 4.6.12, 4.7.4
Typo3 Backend History Module Vulnerable to SQL Injection
- Affected
- >=4.5.0 <4.5.21 · >=4.6.0 <4.6.14 · >=4.7.0 <4.7.6
- Fixed in
- 4.5.21, 4.6.14, 4.7.6
Typo3 Backend API XSS Vulnerability
- Affected
- >=4.5.0 <4.5.21 · >=4.6.0 <4.6.14 · >=4.7.0 <4.7.6
- Fixed in
- 4.5.21, 4.6.14, 4.7.6
Typo3 Function Menu API XSS Vulnerability
- Affected
- >=4.5.0 <4.5.21 · >=4.6.0 <4.6.14 · >=4.7.0 <4.7.6
- Fixed in
- 4.5.21, 4.6.14, 4.7.6
Typo3 Backend History Module Vulnerable to XSS
- Affected
- >=4.5.0 <4.5.21 · >=4.6.0 <4.6.14 · >=4.7.0 <4.7.6
- Fixed in
- 4.5.21, 4.6.14, 4.7.6
TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component
- Affected
- >=4.5.0 <4.5.32 · >=4.7.0 <4.7.17 · >=6.0.0 <6.0.12 · >=6.1.0 <6.1.7
- Fixed in
- 4.5.32, 4.7.17, 6.0.12, 6.1.7
TYPO3 Arbitrary Code Execution
- Affected
- >=7.6.0 <7.6.22 · >=8.0.0 <8.7.5
- Fixed in
- 7.6.22, 8.7.5
Typo3 Host Header Spoofing Vulnerability
- Affected
- >=4.5.0 <4.5.34 · >=4.7.0 <4.7.19 · >=6.0.0 <6.0.14 · >=6.1.0 <6.1.9 · >=6.2.0 <6.2.3
- Fixed in
- 4.5.34, 4.7.19, 6.0.14, 6.1.9, 6.2.3
TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code
- Affected
- >=4.5.0 <4.5.34 · >=4.7.0 <4.7.19 · >=6.0.0 <6.0.14 · >=6.1.0 <6.1.9
- Fixed in
- 4.5.34, 4.7.19, 6.0.14, 6.1.9
Typo3 XSS Vulnerabilities
- Affected
- >=4.5.0 <4.5.34 · >=4.7.0 <4.7.19 · >=6.0.0 <6.0.14 · >=6.1.0 <6.1.9 · >=6.2.0 <6.2.3
- Fixed in
- 4.5.34, 4.7.19, 6.0.14, 6.1.9, 6.2.3
Typo3 XSS Vulnerability
- Affected
- <9.2.0
- Fixed in
- 9.2.0
TYPO3 cross-site scripting (XSS)
- Affected
- >=6.0 <6.2.15 · >=7.0 <7.4.0 · >=4.0 <=4.5.40
- Fixed in
- 6.2.15, 7.4.0
TYPO3 Information Disclosure Vulnerability
- Affected
- 7.6.15
- Fixed in
- No fix released
Moodle cross-site scripting (XSS) vulnerabilities
- Affected
- >=6.2.0 <6.2.14 · >=7.0.0 <7.3.1
- Fixed in
- 6.2.14, 7.3.1
TYPO3 PHP remote file inclusion vulnerability
- Affected
- >=4.3.0 <4.3.3
- Fixed in
- 4.3.3
TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential
- Affected
- <=4.0.13 · >=4.1.0 <4.1.13 · >=4.2.0 <4.2.10 · >=4.3beta1 <4.3beta2
- Fixed in
- 4.1.13, 4.2.10, 4.3beta2
Typo3 Backend XSS Vulnerability
- Affected
- >=3.3.0 · >=4.0 <4.0.12 · >=4.1.0 <4.1.10 · >=4.2.0 <4.2.6 · 4.3alpha1
- Fixed in
- 4.0.12, 4.1.10, 4.2.6
TYPO3 leaks a hash secret in an error message
- Affected
- >=3.3 <4.0.12 · >=4.1 <4.1.10 · >=4.2 <4.2.6
- Fixed in
- 4.0.12, 4.1.10, 4.2.6
Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection
- Affected
- >=4.0.0 <4.0.10 · >=4.1.0 <4.1.8 · >=4.2.0 <4.2.4
- Fixed in
- 4.0.10, 4.1.8, 4.2.4
Authentication library in TYPO3 vulnerable to session fixation
- Affected
- >=4.0.0 <4.0.10 · >=4.1.0 <4.1.8 · >=4.2.0 <4.2.4
- Fixed in
- 4.0.10, 4.1.8, 4.2.4
TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/`
- Affected
- <3.8.1
- Fixed in
- 3.8.1
Typo3 SQL injection due to faulty prepared statements
- Affected
- >=4.5.0 <=4.5.5
- Fixed in
- No fix released
Typo3 Authentication Bypass
- Affected
- <4.3.12 · >=4.4.0 <4.4.9 · >=4.5.0 <4.5.4
- Fixed in
- 4.3.12, 4.4.9, 4.5.4
Typo3 XSS Vulnerability
- Affected
- >=4.5.0 <4.5.4 · >=4.4.0 <4.4.9 · <4.3.12
- Fixed in
- 4.3.12, 4.4.9, 4.5.4
Typo3 Arbitrary Information Disclosure
- Affected
- <4.3.12 · >=4.4.0 <4.4.9 · >=4.5.0 <4.5.4
- Fixed in
- 4.3.12, 4.4.9, 4.5.4
Typo3 Arbitrary File Delete
- Affected
- <4.3.12 · >=4.4.0 <4.4.9 · >=4.5.0 <4.5.4
- Fixed in
- 4.3.12, 4.4.9, 4.5.4
Typo3 XSS Vulnerabilities
- Affected
- <4.3.12 · >=4.4.0 <4.4.9 · >=4.5.0 <4.5.4
- Fixed in
- 4.3.12, 4.4.9, 4.5.4
Typo3 XSS in RemoveXSS function
- Affected
- <4.3.12 · >=4.4.0 <4.4.9 · >=4.5.0 <4.5.4
- Fixed in
- 4.3.12, 4.4.9, 4.5.4
Typo3 Improper Access Control
- Affected
- <4.4.9 · >=4.5.0 <4.5.4
- Fixed in
- 4.4.9, 4.5.4
Typo3 Information Disclosure
- Affected
- <4.5.4
- Fixed in
- 4.5.4
Typo3 Information Disclosure
- Affected
- <4.3.12 · >=4.4.0 <4.4.9 · >=4.5.0 <4.5.4
- Fixed in
- 4.3.12, 4.4.9, 4.5.4
Cross-Site-Request-Forgery in Backend
- Affected
- >=11.2.0 <11.5.0
- Fixed in
- 11.5.0
HTTP Host Header Injection
- Affected
- >=11.0.0 <11.5.0
- Fixed in
- 11.5.0
Cross-Site Scripting via Rich-Text Content
- Affected
- >=10.0.0 <10.4.19 · >=11.0.0 <11.3.2 · >=9.0.0 <9.5.29 · >=8.0.0 <8.7.42 · >=7.0.0 <7.6.53
- Fixed in
- 7.6.53, 8.7.42, 9.5.29, 10.4.19, 11.3.2
Information Disclosure in User Authentication
- Affected
- >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1 · >=9.0.0 <9.5.28
- Fixed in
- 9.5.28, 10.4.18, 11.3.1
Cross-Site Scripting in Backend Grid View
- Affected
- >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1 · >=9.0.0 <9.5.28
- Fixed in
- 9.5.28, 10.4.18, 11.3.1
Cross-Site Scripting in Query Generator & Query View
- Affected
- >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1 · >=9.0.0 <9.5.28
- Fixed in
- 9.5.28, 10.4.18, 11.3.1
Cross-Site Scripting in Page Preview
- Affected
- >=10.0.0 <10.4.18 · >=11.0.0 <11.3.1 · >=9.0.0 <9.5.28
- Fixed in
- 9.5.28, 10.4.18, 11.3.1
Cross-Site Scripting in Content Preview (CType menu)
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 9.5.25, 10.4.14, 11.1.1
Denial of Service in Page Error Handling
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 9.5.25, 10.4.14, 11.1.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1
- Fixed in
- 10.4.14, 11.1.1
Broken Access Control in Form Framework
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 9.5.25, 10.4.14, 11.1.1
Unrestricted File Upload in Form Framework
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 9.5.25, 10.4.14, 11.1.1
Cross-Site Scripting in Content Preview
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1
- Fixed in
- 10.4.14, 11.1.1
Cleartext storage of session identifier
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 9.5.25, 10.4.14, 11.1.1
Open Redirection in Login Handling
- Affected
- >=10.0.0 <10.4.14 · >=11.0.0 <11.1.1 · >=9.0.0 <9.5.25
- Fixed in
- 9.5.25, 10.4.14, 11.1.1
Cross-Site Scripting in Fluid view helpers
- Affected
- >=10.0.0 <10.4.10 · >=9.0.0 <9.5.23 · >=8.7.0 <8.7.38
- Fixed in
- 8.7.38, 9.5.23, 10.4.10
XML External Entity in Dashboard Widget
- Affected
- >=10.0.0 <10.4.10
- Fixed in
- 10.4.10
Cleartext storage of session identifier
- Affected
- >=10.0.0 <10.4.10 · >=9.0.0 <9.5.23 · >=8.7.0 <8.7.38
- Fixed in
- 8.7.38, 9.5.23, 10.4.10
Cross-Site Scripting in ternary conditional operator
- Affected
- >=8.0.0 <8.7.25 · >=9.0.0 <9.5.6
- Fixed in
- 8.7.25, 9.5.6
Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS
- Affected
- >=10.0.0 <10.4.6 · >=9.0.0 <9.5.20
- Fixed in
- 9.5.20, 10.4.6
Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS
- Affected
- >=10.0.0 <10.4.6 · >=9.0.0 <9.5.20
- Fixed in
- 9.5.20, 10.4.6
Backend Same-Site Request Forgery in TYPO3 CMS
- Affected
- >=10.0.0 <10.4.2 · >=9.0.0 <9.5.17
- Fixed in
- 9.5.17, 10.4.2
Insecure Deserialization in Backend User Settings in TYPO3 CMS
- Affected
- >=10.0.0 <10.4.2 · >=9.0.0 <9.5.17
- Fixed in
- 9.5.17, 10.4.2
Class destructors causing side-effects when being unserialized in TYPO3 CMS
- Affected
- >=10.0.0 <10.4.2 · >=9.0.0 <9.5.17
- Fixed in
- 9.5.17, 10.4.2
Cross-Site Scripting in TYPO3 CMS Link Handling
- Affected
- >=10.0.0 <10.4.2 · >=9.0.0 <9.5.17
- Fixed in
- 9.5.17, 10.4.2
Cross-Site Scripting in TYPO3 CMS Form Engine
- Affected
- >=10.0.0 <10.4.2 · >=9.0.0 <9.5.17
- Fixed in
- 9.5.17, 10.4.2
Information Disclosure in Password Reset
- Affected
- >=10.0.0 <10.4.2
- Fixed in
- 10.4.2
Deserialization of untrusted data in Symfony
- Affected
- >=9.0.0 <9.5.8
- Fixed in
- 9.5.8
Ckeditor XSS Vulnerability
- Affected
- >=8.0.0 <8.7.21 · >=9.0.0 <9.5.2
- Fixed in
- 8.7.21, 9.5.2
Bootstrap Cross-site Scripting vulnerability
- Affected
- >=8.0.0 <8.7.23 · >=9.0.0 <9.5.4
- Fixed in
- 8.7.23, 9.5.4
Which of your client projects still run an old typo3/cms?
NPMscan reads the composer.lock in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other Composer packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the Composer registry.