ke_search for Typo3 XSS Vulnerability

Description

References

• nvd.nist.gov/vuln/detail/CVE-2020-15517 · ADVISORY
• tpwd/ke_search commit 1cde32c · WEB
• tpwd/ke_search commit 9551aa4 · WEB
• tpwd/ke_search · PACKAGE
• typo3.org/security/advisory/typo3-ext-sa-2020-009 · WEB
• typo3.org/help/security-advisories · Third Party Advisory

Weitere Schwachstellen in tpwd/ke_search

• CVE-2026-46724MITTEL 5.9The file indexer does not normalize the configured directory path. A backend user with permission to edit indexer configurations can index d…
• CVE-2026-46723MITTEL 5.9The additional_tables configuration of the page and tt_content indexers accepts arbitrary table and field names. A backend user with permiss…
• CVE-2026-46722MITTEL 5.9The OOXML parsing of the file indexer does not disable external entity resolution. A crafted xlsx or pptx document placed in an indexed dire…
• CVE-2023-35783MITTEL 6.1The ke_search (aka Faceted Search) extension before 4.0.3, 4.1.x through 4.6.x before 4.6.6, and 5.x before 5.0.2 for TYPO3 allows XSS via i…