TY
Product
typo3
220
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 4High 35Medium 96Low 4
Watch
Add typo3 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2010-3665 | 5.4 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3660 | 5.4 | Nov 1 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3659 | 5.4 | Oct 20 | Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +26 more |
| CVE-2015-8759 | 5.4 | Jan 8 | Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web… Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +33 more |
| CVE-2015-8758 | 5.4 | Jan 8 | Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to… Affected: 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +33 more |
| CVE-2015-8756 | 5.4 | Jan 8 | Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed_search) component in TYPO3 6.2.x before 6.2.16 allows remote authenticated… Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +23 more |
| CVE-2015-8755 | 5.4 | Jan 8 | Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to… Affected: 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +33 more |
| CVE-2025-47937 | 5.3 | May 20 | TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling Affected: >= 9.0.0, < 9.5.51; >= 10.0.0, < 10.4.50; >= 11.0.0, < 11.5.44; >= 12.0.0, < 12.4.31; >= 13.0.0, < 13.4.12 |
| CVE-2024-55891 | 5.3 | Jan 14 | Information Disclosure via Exception Handling/Logger in TYPO3 Affected: < 13.4.3 |
| CVE-2024-45232 | 5.3 | Aug 28 | An issue was discovered in powermail extension through 12.3.5 for TYPO3 Affected: before 12.4.0 |
| CVE-2024-34358 | 5.3 | May 14 | TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController Affected: >= 9.0.0, < 9.5.48; >= 10.0.0, < 10.4.45; >= 11.0.0, < 11.5.37; >= 12.0.0, < 12.4.15; >= 13.0.0, < 13.1.1 |
| CVE-2023-47126 | 5.3 | Nov 14 | Information Disclosure in Install Tool in typo3/cms-install Affected: >= 12.2.0, < 12.4.8 |
| CVE-2023-38499 | 5.3 | Jul 25 | TYPO3 is an open source PHP based web content management system Affected: 9.4.0 before 9.5.42; 10.0.0 before 10.4.39; 11.0.0 before 11.5.30; 12.0.0 before 12.4.4 |
| CVE-2022-36105 | 5.3 | Sep 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 7.0.0 through 7.6.57; 8.0.0 through 8.7.47; 9.0.0 through 9.5.36; 10.0.0 through 10.4.31; 11.0.0 through 11.5.15 |
| CVE-2021-41114 | 5.3 | Oct 5 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 11.0.0 before 11.5.0 |
| CVE-2010-3673 | 5.3 | Nov 5 | TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API Affected: 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3667 | 5.3 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3666 | 5.3 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2017-6370 | 5.3 | Mar 17 | TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by… Affected: 7.6.15 |
| CVE-2024-34537 | 4.9 | Oct 28 | TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated… Affected: 10.0.0 before 10.4.46; 11.0.0 before 11.5.40; 12.0.0 before 12.4.21; 13.0.0 before 13.3.1 |
| CVE-2024-25119 | 4.9 | Feb 13 | Information Disclosure of Encryption Key in TYPO3 Install Tool Affected: >= 13.0.0, < 13.0.1; >= 12.0.0, < 12.4.11; >= 11.0.0, < 11.5.35; >= 10.0.0, < 10.4.43; >= 9.0.0, < 9.5.46; >= 8.0.0, < 8.7.57 |
| CVE-2023-30451 | 4.9 | Dec 25 | In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as… Affected: 11.5.24 |
| CVE-2022-23504 | 4.9 | Dec 14 | TYPO3 is an open source PHP based web content management system Affected: 9.0.0 before 9.5.38; 10.0.0 before 10.4.33; 11.0.0 before 11.5.20; 12.0.0 before 12.1.1 |
| CVE-2021-32668 | 4.8 | Jul 20 | TYPO3 is an open source PHP based web content management system Affected: 8.0.0 through 8.7.40; 9.0.0 through 9.5.28; 10.0.0 through 10.4.17; 11.0.0 through 11.3.0 |
| CVE-2010-3670 | 4.8 | Nov 5 | TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot password" function Affected: before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2018-6905 | 4.8 | Apr 8 | The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the… Affected: before 8.7.11; 9.0.0 before 9.1.0 |
| CVE-2025-47936 | 4.4 | May 20 | TYPO3 Vulnerable to Server Side Request Forgery via Webhooks Affected: >= 12.0.0, < 12.4.31; >= 13.0.0, < 13.4.12 |
| CVE-2025-59019 | 4.3 | Sep 9 | Information Disclosure via CSV Download Affected: 11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 |
| CVE-2025-59016 | 4.3 | Sep 9 | Information Disclosure via File Abstraction Layer Affected: 9.0.0 before 9.5.55; 10.0.0 through 10.4.54; 11.0.0 through 11.5.48; 12.0.0 through 12.4.37; 13.0.0 through 13.4.18 |
| CVE-2024-55893 | 4.3 | Jan 14 | TYPO3 Cross-Site Request Forgery in Log Module Affected: >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3 |
| CVE-2024-55920 | 4.3 | Jan 14 | Cross-Site Request Forgery in Dashboard Module in TYPO3 Affected: >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3 |
| CVE-2024-55923 | 4.3 | Jan 14 | Cross-Site Request Forgery in Indexed Search Module in TYPO3 Affected: >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3 |
| CVE-2024-47780 | 4.3 | Oct 8 | Information Disclosure in TYPO3 Page Tree Affected: >= 10.0.0, < 10.4.46; >= 11.0.0, < 11.5.40; >= 12.0.0, < 12.4.21; >= 13.0.0, < 13.3.1 |
| CVE-2024-25120 | 4.3 | Feb 13 | Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3 Affected: >= 13.0.0, < 13.0.1; >= 12.0.0, < 12.4.11; >= 11.0.0, < 11.5.35; >= 10.0.0, < 10.4.43; >= 9.0.0, < 9.5.46; >= 8.0.0, < 8.7.57 |
| CVE-2022-31046 | 4.3 | Jun 14 | TYPO3 is an open source web content management system Affected: 7.0.0 before 7.6.57; 8.0.0 before 8.7.47; 9.0.0 before 9.5.35; 10.0.0 before 10.4.29; 11.0.0 before 11.5.11 |
| CVE-2025-47938 | 3.8 | May 20 | TYPO3 Vulnerable to Unverified Password Change for Backend Users Affected: >= 9.0.0, < 9.5.51; >= 10.0.0, < 10.4.50; >= 11.0.0, < 11.5.44; >= 12.0.0, < 12.4.31; >= 13.0.0, < 13.4.12 |
| CVE-2020-26229 | 3.7 | Nov 23 | TYPO3 is an open source PHP based web content management system Affected: 10.0.0 before 10.4.10 |
| CVE-2020-11063 | 3.7 | May 13 | In TYPO3 CMS versions 10.4.0 and 10.4.1, it has been discovered that time-based attacks can be used with the password reset functionality for backend users Affected: 10.4.0; 10.4.1 |
| CVE-2025-59014 | 2.7 | Sep 9 | Denial of Service in TYPO3 Bookmark Toolbar Affected: 11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 |
| CVE-2015-5956 | – | Sep 16 | The sanitizeLocalUrl function in TYPO3 6.x before 6.2.15, 7.x before 7.4.0, 4.5.40, and earlier allows remote authenticated users to bypass the XSS filter and conduct cross-site… Affected: through 4.5.40; 6.0; 6.0.1; 6.0.2; 6.0.3; 6.0.4; +34 more |
| CVE-2015-2047 | – | Feb 23 | The rsaauth extension in TYPO3 4.3.0 through 4.3.14, 4.4.0 through 4.4.15, 4.5.0 through 4.5.39, and 4.6.0 through 4.6.18, when configured for the frontend, allows remote… Affected: 4.3.0; 4.3.1; 4.3.2; 4.3.3; 4.3.4; 4.3.5; +34 more |
| CVE-2014-9509 | – | Jan 4 | The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to all or cached,… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +34 more |
| CVE-2014-9508 | – | Jan 4 | The frontend rendering component in TYPO3 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set and using a homepage… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +34 more |
| CVE-2014-3946 | – | Jun 3 | The query caching functionality in the Extbase Framework component in TYPO3 6.2.0 before 6.2.3 does not properly validate group permissions, which allows remote authenticated… Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.1; 6.2.2 |
| CVE-2014-3945 | – | Jun 3 | The Authentication component in TYPO3 before 6.2, when salting for password hashing is disabled, does not require knowledge of the cleartext password if the password hash is… Affected: through 6.1.9; 4.0; 4.0.0; 4.0.1; 4.0.2; 4.0.3; +34 more |
| CVE-2014-3944 | – | Jun 3 | The Authentication component in TYPO3 6.2.0 before 6.2.3 does not properly invalidate timed out user sessions, which allows remote attackers to bypass authentication via… Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.1; 6.2.2 |
| CVE-2014-3943 | – | Jun 3 | Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9,… Affected: 4.5.0; 4.5.1; 4.5.2; 4.5.3; 4.5.4; 4.5.5; +34 more |
| CVE-2014-3942 | – | Jun 3 | The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute… Affected: 6.1; 6.1.1; 6.1.2; 6.1.3; 6.1.4; 6.1.5; +34 more |
| CVE-2014-3941 | – | Jun 3 | TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, 6.1.0 before 6.1.9, and 6.2.0 before 6.2.3 allows remote attackers to have unspecified impact via a crafted… Affected: 4.7.0; 4.7.1; 4.7.2; 4.7.3; 4.7.4; 4.7.5; +34 more |
| CVE-2013-4321 | – | May 20 | The File Abstraction Layer (FAL) in TYPO3 6.0.x before 6.0.8 and 6.1.x before 6.1.4 allows remote authenticated editors to execute arbitrary PHP code via unspecified characters in… Affected: 6.1; 6.1.1; 6.1.2; 6.1.3; 6.0; 6.0.1; +6 more |