CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 30/05/2024 |
| GHSA-wp8j-c736-c5r3 | 中危5.4 | TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors | 30/05/2024 |
| GHSA-r9vc-jfmh-6j48 | 高危7.1 | TYPO3 frontend login vulnerable to Session Fixation | 30/05/2024 |
| GHSA-4r76-xr68-w7m7 | 高危8.8 | TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts | 30/05/2024 |
| GHSA-p84g-j2gh-83g3 | 高危 | TYPO3 possible cache poisoning on the homepage when anchors are used | 30/05/2024 |
| GHSA-mxjf-hc9v-xgv2 | 中危6.1 | ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting | 30/05/2024 |
| GHSA-45xg-4w5x-j429 | 高危8.1 | TYPO3 Arbitrary Shell Execution in Swiftmailer library | 30/05/2024 |
| GHSA-gj48-w74w-8gvm | 中危 | Path Traversal in TYPO3 Core | 22/02/2024 |
| CVE-2023-24814 | 中危6.1 | TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows attackers to inject malicious content. In combination with th | 07/02/2023 |
| CVE-2022-47406 | 严重9.8 | An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed. | 14/12/2022 |
| CVE-2022-23504 | 中危4.9 | TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Disclosure. Due to the lack of handling user-submitted YAML placeholder expressions in the site configuration backend module, attackers could expose sensitive inte | 14/12/2022 |
| CVE-2022-23503 | 高危8.8 | TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible to inject code instructi | 14/12/2022 |
| CVE-2022-23502 | 中危5.4 | TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the corresponding password recovery functionality, existing sessions for that particular user account were not revoked. This applied to both frontend user sessions an | 14/12/2022 |
| CVE-2022-23501 | 中危6.5 | TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Improper Authentication. Restricting frontend login to specific users, organized in different storage folders (partitions), can be bypassed. A potential attacker migh | 14/12/2022 |
| CVE-2022-23500 | 高危7.5 | TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing resources via HTTP triggers the page error handler, which again could retrieve content to be shown as an error message from another page. This leads to a scenari | 14/12/2022 |
| CVE-2022-23499 | 中危6.1 | HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the upstream package mastermi | 13/12/2022 |