TY
Product
Typo3
218
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 3High 35Medium 95Low 4
Watch
Add Typo3 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-11066 | 10.0 | May 14 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, calling unserialize() on malicious user-submitted… Affected: 9.0.0 before 9.5.17; 10.0.0 before 10.4.2 |
| CVE-2011-3583 | 9.8 | Nov 26 | It was found that Typo3 Core versions 4.5.0 - 4.5.5 uses prepared statements that, if the parameter values are not properly replaced, could lead to a SQL Injection vulnerability Affected: 4.5.0 through 4.5.5 |
| CVE-2011-4628 | 9.8 | Nov 6 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2025-59017 | 8.8 | Sep 9 | Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to… Affected: 9.0.0 before 9.5.55; 10.0.0 before 10.4.54; 11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 |
| CVE-2024-55921 | 8.8 | Jan 14 | TYPO3 is a free and open source Content Management Framework Affected: 10.0.0 before 10.4.48; 11.0.0 before 11.5.42; 12.0.0 before 12.4.25; 13.0.0 before 13.4.3 |
| CVE-2022-23503 | 8.8 | Dec 14 | TYPO3 is an open source PHP based web content management system Affected: 8.0.0 before 8.7.49; 9.0.0 before 9.5.38; 10.0.0 before 10.4.33; 11.0.0 before 11.5.20; 12.0.0 before 12.1.1 |
| CVE-2021-41113 | 8.8 | Oct 5 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 11.2.0 before 11.5.0 |
| CVE-2020-15098 | 8.8 | Jul 29 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, it has been discovered that an internal verification… Affected: 9.0.0 before 9.5.20; 10.0.0 before 10.4.6 |
| CVE-2020-11069 | 8.8 | May 14 | In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery Affected: 9.0.0 through 9.5.16; 10.0.0 through 10.4.1 |
| CVE-2020-11067 | 8.8 | May 14 | In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization Affected: 9.0.0 through 9.5.16; 10.0.0 through 10.4.1 |
| CVE-2019-19849 | 8.8 | Dec 17 | An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2 Affected: before 8.7.30; 9.0.0 before 9.5.12; 10.0.0 before 10.2.2 |
| CVE-2010-3663 | 8.8 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains an insecure default value of the variable fileDenyPattern which could allow remote… Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3662 | 8.8 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2019-12747 | 8.8 | Jul 9 | TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data Affected: 8.3.0 through 8.7.26; 9.0.0 through 9.5.7 |
| CVE-2017-14251 | 8.8 | Sep 11 | Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote… Affected: 7.6.0; 7.6.1; 7.6.2; 7.6.3; 7.6.4; 7.6.5; +34 more |
| CVE-2021-21355 | 8.6 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 8.0.0 before 8.7.40; 9.0.0 before 9.5.25; 10.0.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2021-21357 | 8.3 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 8.0.0 before 8.7.40; 9.0.0 before 9.5.25; 10.0.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2025-59022 | 8.1 | Jan 13 | TYPO3 CMS Allows Broken Access Control in Recycler Module Affected: 10.0.0 before 10.4.55; 11.0.0 before 11.5.49; 12.0.0 before 12.4.41; 13.0.0 before 13.4.23; 14.0.0 before 14.0.2 |
| CVE-2020-15099 | 8.1 | Jul 29 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid… Affected: 9.0.0 before 9.5.20; 10.0.0 before 10.4.6 |
| CVE-2016-5091 | 8.1 | Jan 23 | Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase… Affected: through 6.2.23; 7.0.0; 7.0.2; 7.1.0; 7.2.0; 7.3.0; +13 more |
| CVE-2024-55924 | 8.0 | Jan 14 | TYPO3 is a free and open source Content Management Framework Affected: 11.0.0 before 11.5.42 |
| CVE-2026-0859 | 7.8 | Jan 13 | TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool Affected: 10.0.0 before 10.4.55; 11.0.0 before 11.5.49; 12.0.0 before 12.4.41; 13.0.0 before 13.4.23; 14.0.0 before 14.0.2 |
| CVE-2026-6553 | 7.5 | Apr 21 | TYPO3 CMS Stores Cleartext Password in User Settings Module Affected: 14.2.0 |
| CVE-2022-23500 | 7.5 | Dec 14 | TYPO3 is an open source PHP based web content management system Affected: 9.0.0 before 9.5.38; 10.0.0 before 10.4.33; 11.0.0 before 11.5.20 |
| CVE-2022-36104 | 7.5 | Sep 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 11.4.0 through 11.5.15 |
| CVE-2021-21359 | 7.5 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 9.0.0 before 9.5.25; 10.0.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2021-21339 | 7.5 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 6.2.0 before 6.2.57; 7.0.0 before 7.6.51; 8.0.0 before 8.7.40; 9.0.0 before 9.5.25; 10.0.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2020-26228 | 7.5 | Nov 23 | TYPO3 is an open source PHP based web content management system Affected: 9.0.0 before 9.5.23; 10.0.0 before 10.4.10 |
| CVE-2010-3668 | 7.5 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Header Injection in the secure download feature jumpurl Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2019-11832 | 7.5 | May 9 | TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing, as demonstrated by… Affected: 8.0.0 before 8.7.25; 9.0.0 before 9.5.6 |
| CVE-2009-0255 | 7.5 | Jan 22 | The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which… Affected: 4.0 before 4.0.10; 4.1.0 before 4.1.8; 4.2.0 before 4.2.4 |
| CVE-2025-47941 | 7.2 | May 20 | TYPO3 is an open source, PHP based web content management system Affected: 12.0.0 before 12.4.31; 13.0.0 before 13.4.12 |
| CVE-2025-47940 | 7.2 | May 20 | TYPO3 is an open source, PHP based web content management system Affected: 10.4.0 before 10.4.50; 11.0.0 before 11.5.44; 12.0.0 before 12.4.31; 13.0.0 before 13.4.12 |
| CVE-2024-22188 | 7.2 | Mar 5 | TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a… Affected: 8.0.0 before 8.7.57; 9.0.0 before 9.5.46; 10.0.0 before 10.4.43; 11.0.0 before 11.5.35; 12.0.0 before 12.4.11; 13.0.0 |
| CVE-2022-31050 | 7.2 | Jun 14 | TYPO3 is an open source web content management system Affected: 9.0.0 before 9.5.35; 10.0.0 before 10.4.29; 11.0.0 before 11.5.11 |
| CVE-2019-19850 | 7.2 | Dec 17 | An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2 Affected: 8.0.0 before 8.7.30; 9.0.0 before 9.5.12; 10.0.0 before 10.2.2 |
| CVE-2019-19848 | 7.2 | Dec 17 | An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2 Affected: before 8.7.30; 9.0.0 before 9.5.12; 10.0.0 before 10.2.2 |
| CVE-2024-25121 | 7.1 | Feb 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 8.0.0 before 8.7.57; 9.0.0 before 9.5.46; 10.0.0 before 10.4.43; 11.0.0 before 11.5.35; 12.0.0 before 12.4.11; 13.0.0 |
| CVE-2025-59020 | 6.5 | Jan 13 | TYPO3 CMS Allows Broken Access Control in Edit Document Controller Affected: 10.0.0 before 10.4.55; 11.0.0 before 11.5.49; 12.0.0 before 12.4.41; 13.0.0 before 13.4.23; 14.0.0 before 14.0.2 |
| CVE-2025-59018 | 6.5 | Sep 9 | Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to… Affected: 9.0.0 before 9.5.55; 10.0.0 before 10.4.54; 11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 |
| CVE-2025-59015 | 6.5 | Sep 9 | A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry… Affected: 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 |
| CVE-2025-7900 | 6.5 | Jul 22 | The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata Affected: through 6.4.1; 7.0.0 through 7.5.2; 8.0.0 through 8.3.0 |
| CVE-2024-55945 | 6.5 | Jan 14 | TYPO3 is a free and open source Content Management Framework Affected: 11.0.0 before 11.5.42 |
| CVE-2024-25118 | 6.5 | Feb 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 8.0.0 before 8.7.57; 9.0.0 before 9.5.46; 10.0.0 before 10.4.43; 11.0.0 before 11.5.35; 12.0.0 before 12.4.11; 13.0.0 |
| CVE-2022-23501 | 6.5 | Dec 14 | TYPO3 is an open source PHP based web content management system Affected: before 8.7.49; 9.0.0 before 9.5.38; 10.0.0 before 10.4.33; 11.0.0 before 11.5.20; 12.0.0 before 12.1.1 |
| CVE-2022-31047 | 6.5 | Jun 14 | TYPO3 is an open source web content management system Affected: 7.0.0 before 7.6.57; 8.0.0 before 8.7.47; 9.0.0 before 9.5.35; 10.0.0 before 10.4.29; 11.0.0 before 11.5.11 |
| CVE-2021-32767 | 6.5 | Jul 20 | TYPO3 is an open source PHP based web content management system Affected: 7.0.0 through 7.6.51; 8.0.0 through 8.7.40; 9.0.0 through 9.5.27; 10.0.0 through 10.4.17; 11.0.0 through 11.3.0 |
| CVE-2011-4904 | 6.5 | Nov 6 | TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services Affected: 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4902 | 6.5 | Nov 6 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4901 | 6.5 | Nov 6 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |