TYPO3 Cross-site Scripting vulnerability in the file backend module

Description

References

• nvd.nist.gov/vuln/detail/CVE-2008-5644 · ADVISORY
• exchange.xforce.ibmcloud.com/vulnerabilities/46585 · WEB
• TYPO3-CMS/backend · PACKAGE
• web.archive.org/web/20111229084039/http://secunia.com/advisories/32689 · WEB
• web.archive.org/web/20200301075354/http://www.securityfocus.com/bid/32284 · WEB
• typo3.org/teams/security/security-bulletins/typo3-20081113-1 · WEB
• secunia.com/advisories/32689 · Vendor Advisory
• typo3.org/teams/security/security-bulletins/typo3-20081113-1 · Vendor Advisory
• securityfocus.com/bid/32284
• vupen.com/english/advisories/2008/3144

Mais vulnerabilidades de typo3/cms-backend

• CVE-2026-19418ALTO 7.3The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started …
• CVE-2026-47352MÉDIO 5.3Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing ac…
• CVE-2026-47351MÉDIO 5.3Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed …
• CVE-2026-6553ALTO 7.5Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields …
• CVE-2025-59020MÉDIO 6.5By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave…