Login Request a demo
TY
Product
typo3
by TYPO3 · last CVE Apr 21, 2026
220
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities220In the news0Timeline
Severity mix
Critical 4High 35Medium 96Low 4
Severity
All severities220Critical4High35Medium96Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add typo3 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2011-4901
6.5
1%
Nov 6
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database
Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4
CVE-2011-4900
6.5
1%
Nov 6
TYPO3 before 4.5.4 allows Information Disclosure in the backend
Affected: 4.5.0 before 4.5.4
CVE-2011-4627
6.5
1%
Nov 6
TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend
Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4
CVE-2010-3671
6.5
2%
Nov 5
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session
Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1
CVE-2010-3664
6.5
1%
Nov 4
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend
Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1
CVE-2025-59021
6.4
0%
Jan 13
TYPO3 CMS Allows Broken Access Control in Redirects Module
Affected: 10.0.0 before 10.4.55; 11.0.0 before 11.5.49; 12.0.0 before 12.4.41; 13.0.0 before 13.4.23; 14.0.0 before 14.0.2
CVE-2025-59013
6.1
0%
Sep 9
Open Redirect in TYPO3 CMS
Affected: 9.0.0 before 9.5.55; 10.0.0 before 10.4.54; 11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18
CVE-2024-55892
6.1
0%
Jan 14
Potential Open Redirect via Parsing Differences in TYPO3
Affected: >= 9.0.0, < 9.5.49; >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3
CVE-2023-47125
6.1
1%
Nov 14
By-passing Cross-Site Scripting Protection in HTML Sanitizer
Affected: 8.7.42 before 8.7.55; 9.5.29 before 9.5.44; 10.4.19 before 10.4.41; 11.3.2 before 11.5.33; 12.0.0 before 12.4.8
CVE-2023-24814
6.1
1%
Feb 7
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License
Affected: 8.7.0 before 9.7.51; 9.0.0 before 9.5.40; 10.0.0 before 10.4.36; 11.0.0 before 11.5.23; 12.0.0 before 12.2.0
CVE-2022-36108
6.1
1%
Sep 13
TYPO3 is an open source PHP based web content management system released under the GNU GPL
Affected: 10.0.0 through 10.4.31; 11.0.0 through 11.5.15
CVE-2021-32768
6.1
1%
Aug 10
TYPO3 is an open source PHP based web content management system released under the GNU GPL
Affected: 7.0.0 through 7.6.52; 8.0.0 through 8.7.41; 9.0.0 through 9.5.28; 10.0.0 through 10.4.18; 11.0.0 through 11.3.1
CVE-2021-21338
6.1
1%
Mar 23
TYPO3 is an open source PHP based web content management system
Affected: 6.2.0 before 6.2.57; 7.0.0 before 7.6.51; 8.0.0 before 8.7.40; 9.0.0 before 9.5.25; 10.0.0 before 10.4.14; 11.0.0 before 11.1.1
CVE-2020-26227
6.1
1%
Nov 23
TYPO3 is an open source PHP based web content management system
Affected: 6.2.0 before 6.2.54; 7.6.0 before 7.6.48; 8.7.0 before 8.7.38; 9.0.0 before 9.5.23; 10.0.0 before 10.4.10
CVE-2020-15241
6.1
1%
Oct 8
TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the…
Affected: 8.7.25; 9.5.6
CVE-2020-8091
6.1
5%
Jan 27
svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system
Affected: 6.2 before 6.2.39; 7.0.0 through 7.1.0
CVE-2011-4903
6.1
1%
Nov 6
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS…
Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4
CVE-2011-4626
6.1
1%
Nov 6
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the "JSwindow"…
Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4
CVE-2010-3674
6.1
1%
Nov 5
TYPO3 before 4.4.1 allows XSS in the frontend search box
Affected: before 4.4.1
CVE-2010-3672
6.1
1%
Nov 5
TYPO3 before 4.3.4 and 4.4.x before 4.4.1 allows XSS in the textarea view helper in an extbase extension
Affected: before 4.3.4; 4.4.0 before 4.4.1
CVE-2010-3661
6.1
1%
Nov 1
TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend
Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1
CVE-2019-12748
6.1
1%
Jul 9
TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS
Affected: 8.3.0 through 8.7.26; 9.0.0 through 9.5.7
CVE-2016-4056
6.1
1%
Jan 23
Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module…
Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +26 more
CVE-2015-8760
6.1
1%
Jan 8
The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."
Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +23 more
CVE-2015-8757
6.1
1%
Jan 8
Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers to inject arbitrary web script or HTML…
Affected: 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +33 more
CVE-2025-47939
5.4
0%
May 20
TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer
Affected: >= 9.0.0, < 9.5.51; >= 10.0.0, < 10.4.50; >= 11.0.0, < 11.5.44; >= 12.0.0, < 12.4.31; >= 13.0.0, < 13.4.12
CVE-2024-55894
5.4
0%
Jan 14
TYPO3 Cross-Site Request Forgery in Backend User Module
Affected: >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3
CVE-2024-55922
5.4
0%
Jan 14
Cross-Site Request Forgery in Form Framework Module in TYPO3
Affected: >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3
CVE-2024-34357
5.4
1%
May 14
TYPO3 vulnerable to Cross-Site Scripting in ShowImageController
Affected: >= 9.0.0, < 9.5.48; >= 10.0.0, < 10.4.45; >= 11.0.0, < 11.5.37; >= 12.0.0, < 12.4.15; >= 13.0.0, < 13.1.1
CVE-2024-34356
5.4
1%
May 14
TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Module
Affected: >= 9.0.0, < 9.5.48; >= 10.0.0, < 10.4.45; >= 11.0.0, < 11.5.37; >= 12.0.0, < 12.4.15; >= 13.0.0, < 13.1.1
CVE-2024-34355
5.4
1%
May 14
TYPO3 vulnerable to an HTML Injection in the History Module
Affected: >= 13.0.0, < 13.1.1
CVE-2023-47127
5.4
1%
Nov 14
Weak Authentication in Session Handling in typo3/cms-core
Affected: >= 8.0.0, < 8.7.55; >= 9.0.0, < 9.5.44; >= 10.0.0, < 10.4.41; >= 11.0.0, < 11.5.33; >= 12.0.0, < 12.4.8
CVE-2022-23502
5.4
0%
Dec 14
TYPO3 is an open source PHP based web content management system
Affected: 10.0.0 before 10.4.33; 11.0.0 before 11.5.20; 12.0.0 before 12.1.1
CVE-2022-36107
5.4
1%
Sep 13
TYPO3 is an open source PHP based web content management system released under the GNU GPL
Affected: 7.0.0 through 7.6.57; 8.0.0 through 8.7.47; 9.0.0 through 9.5.36; 10.0.0 through 10.4.31; 11.0.0 through 11.5.15
CVE-2022-36106
5.4
1%
Sep 13
TYPO3 is an open source PHP based web content management system released under the GNU GPL
Affected: 10.0.0 through 10.4.31; 11.0.0 through 11.5.15
CVE-2022-31049
5.4
1%
Jun 14
TYPO3 is an open source web content management system
Affected: 9.0.0 before 9.5.35; 10.0.0 before 10.4.29; 11.0.0 before 11.5.11
CVE-2022-31048
5.4
1%
Jun 14
TYPO3 is an open source web content management system
Affected: 8.0.0 before 8.7.47; 9.0.0 before 9.5.35; 10.0.0 before 10.4.29; 11.0.0 before 11.5.11
CVE-2021-32669
5.4
1%
Jul 20
TYPO3 is an open source PHP based web content management system
Affected: 8.0.0 through 8.7.40; 9.0.0 through 9.5.28; 10.0.0 through 10.4.17; 11.0.0 through 11.3.0
CVE-2021-32667
5.4
1%
Jul 20
TYPO3 is an open source PHP based web content management system
Affected: 9.0.0 through 9.5.287; 10.0.0 through 10.4.17; 11.0.0 through 11.3.0
CVE-2021-21365
5.4
1%
Apr 27
Bootstrap Package is a theme for TYPO3
Affected: before 7.1.2; 8.0.0 before 8.0.8; 9.0.0 before 9.0.4; 9.1.0 before 9.1.3; 10.0.0 before 10.0.10; 11.0.0 before 11.0.3
CVE-2021-21370
5.4
1%
Mar 23
TYPO3 is an open source PHP based web content management system
Affected: 7.0.0 before 7.6.51; 8.0.0 before 8.7.40; 9.0.0 before 9.5.25; 10.0.0 before 10.4.14; 11.0.0 before 11.1.1
CVE-2021-21358
5.4
1%
Mar 23
TYPO3 is an open source PHP based web content management system
Affected: 10.2.0 before 10.4.14; 11.0.0 before 11.1.1
CVE-2021-21340
5.4
1%
Mar 23
TYPO3 is an open source PHP based web content management system
Affected: 10.0.0 before 10.4.14; 11.0.0 before 11.1.1
CVE-2020-11065
5.4
1%
May 13
In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by…
Affected: 9.5.12 before 9.5.17; 10.2.0 before 10.4.2
CVE-2020-11064
5.4
1%
May 13
In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placeholder attributes…
Affected: 9.0.0 before 9.5.17; 10.0.0 before 10.4.2
CVE-2011-4632
5.4
1%
Nov 6
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash…
Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4
CVE-2011-4631
5.4
1%
Nov 6
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system…
Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4
CVE-2011-4630
5.4
1%
Nov 6
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links…
Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4
CVE-2011-4629
5.4
1%
Nov 6
Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel
Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4
CVE-2010-3669
5.4
1%
Nov 4
TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box
Affected: 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1
Page 2 of 5 · 220 total
123…5