TY
Product
Typo3
218
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 3High 35Medium 95Low 4
Watch
Add Typo3 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2011-4900 | 6.5 | Nov 6 | TYPO3 before 4.5.4 allows Information Disclosure in the backend Affected: 4.5.0 before 4.5.4 |
| CVE-2011-4627 | 6.5 | Nov 6 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2010-3671 | 6.5 | Nov 5 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3664 | 6.5 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2025-59021 | 6.4 | Jan 13 | TYPO3 CMS Allows Broken Access Control in Redirects Module Affected: 10.0.0 before 10.4.55; 11.0.0 before 11.5.49; 12.0.0 before 12.4.41; 13.0.0 before 13.4.23; 14.0.0 before 14.0.2 |
| CVE-2025-59013 | 6.1 | Sep 9 | Open Redirect in TYPO3 CMS Affected: 9.0.0 before 9.5.55; 10.0.0 before 10.4.54; 11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 |
| CVE-2024-55892 | 6.1 | Jan 14 | TYPO3 is a free and open source Content Management Framework Affected: 9.0.0 before 9.5.49; 10.0.0 before 10.4.48; 11.0.0 before 11.5.42; 12.0.0 before 12.4.25; 13.0.0 before 13.4.3 |
| CVE-2023-47125 | 6.1 | Nov 14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 8.7.42 before 8.7.55; 9.5.29 before 9.5.44; 10.4.19 before 10.4.41; 11.3.2 before 11.5.33; 12.0.0 before 12.4.8 |
| CVE-2023-24814 | 6.1 | Feb 7 | TYPO3 is a free and open source Content Management Framework released under the GNU General Public License Affected: 8.7.0 before 9.7.51; 9.0.0 before 9.5.40; 10.0.0 before 10.4.36; 11.0.0 before 11.5.23; 12.0.0 before 12.2.0 |
| CVE-2022-36108 | 6.1 | Sep 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 10.0.0 through 10.4.31; 11.0.0 through 11.5.15 |
| CVE-2021-32768 | 6.1 | Aug 10 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 7.0.0 through 7.6.52; 8.0.0 through 8.7.41; 9.0.0 through 9.5.28; 10.0.0 through 10.4.18; 11.0.0 through 11.3.1 |
| CVE-2021-21338 | 6.1 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 6.2.0 before 6.2.57; 7.0.0 before 7.6.51; 8.0.0 before 8.7.40; 9.0.0 before 9.5.25; 10.0.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2020-26227 | 6.1 | Nov 23 | TYPO3 is an open source PHP based web content management system Affected: 6.2.0 before 6.2.54; 7.6.0 before 7.6.48; 8.7.0 before 8.7.38; 9.0.0 before 9.5.23; 10.0.0 before 10.4.10 |
| CVE-2020-15241 | 6.1 | Oct 8 | TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the… Affected: 8.7.25; 9.5.6 |
| CVE-2020-8091 | 6.1 | Jan 27 | svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system Affected: 6.2 before 6.2.39; 7.0.0 through 7.1.0 |
| CVE-2011-4903 | 6.1 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS… Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4626 | 6.1 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the "JSwindow"… Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2010-3674 | 6.1 | Nov 5 | TYPO3 before 4.4.1 allows XSS in the frontend search box Affected: before 4.4.1 |
| CVE-2010-3672 | 6.1 | Nov 5 | TYPO3 before 4.3.4 and 4.4.x before 4.4.1 allows XSS in the textarea view helper in an extbase extension Affected: before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3661 | 6.1 | Nov 1 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2019-12748 | 6.1 | Jul 9 | TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS Affected: 8.3.0 through 8.7.26; 9.0.0 through 9.5.7 |
| CVE-2016-4056 | 6.1 | Jan 23 | Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module… Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +26 more |
| CVE-2015-8760 | 6.1 | Jan 8 | The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing." Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +23 more |
| CVE-2015-8757 | 6.1 | Jan 8 | Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers to inject arbitrary web script or HTML… Affected: 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +33 more |
| CVE-2025-47939 | 5.4 | May 20 | TYPO3 is an open source, PHP based web content management system Affected: 9.0.0 before 9.5.51; 10.0.0 before 10.4.50; 11.0.0 before 11.5.44; 12.0.0 before 12.4.31; 13.0.0 before 13.4.12 |
| CVE-2024-55922 | 5.4 | Jan 14 | TYPO3 is a free and open source Content Management Framework Affected: 10.0.0 before 10.4.48; 11.0.0 before 11.5.42; 12.0.0 before 12.4.25; 13.0.0 before 13.4.3 |
| CVE-2024-55894 | 5.4 | Jan 14 | TYPO3 is a free and open source Content Management Framework Affected: 10.0.0 before 10.4.48; 11.0.0 before 11.5.42; 12.0.0 before 12.4.25; 13.0.0 before 13.4.3 |
| CVE-2024-34357 | 5.4 | May 14 | TYPO3 is an enterprise content management system Affected: 9.0.0 before 9.5.48; 10.0.0 before 10.4.45; 11.0.0 before 11.5.37; 12.0.0 before 12.4.15; 13.0.0 before 13.1.1 |
| CVE-2024-34356 | 5.4 | May 14 | TYPO3 is an enterprise content management system Affected: 9.0.0 before 9.5.48; 10.0.0 before 10.4.45; 11.0.0 before 11.5.37; 12.0.0 before 12.4.15; 13.0.0 before 13.1.1 |
| CVE-2024-34355 | 5.4 | May 14 | TYPO3 is an enterprise content management system Affected: 13.0.0 before 13.1.1 |
| CVE-2023-47127 | 5.4 | Nov 14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 8.0.0 before 8.7.55; 9.0.0 before 9.5.44; 10.0.0 before 10.4.41; 11.0.0 before 11.5.33; 12.0.0 before 12.4.8 |
| CVE-2022-23502 | 5.4 | Dec 14 | TYPO3 is an open source PHP based web content management system Affected: 10.0.0 before 10.4.33; 11.0.0 before 11.5.20; 12.0.0 before 12.1.1 |
| CVE-2022-36107 | 5.4 | Sep 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 7.0.0 through 7.6.57; 8.0.0 through 8.7.47; 9.0.0 through 9.5.36; 10.0.0 through 10.4.31; 11.0.0 through 11.5.15 |
| CVE-2022-36106 | 5.4 | Sep 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 10.0.0 through 10.4.31; 11.0.0 through 11.5.15 |
| CVE-2022-31049 | 5.4 | Jun 14 | TYPO3 is an open source web content management system Affected: 9.0.0 before 9.5.35; 10.0.0 before 10.4.29; 11.0.0 before 11.5.11 |
| CVE-2022-31048 | 5.4 | Jun 14 | TYPO3 is an open source web content management system Affected: 8.0.0 before 8.7.47; 9.0.0 before 9.5.35; 10.0.0 before 10.4.29; 11.0.0 before 11.5.11 |
| CVE-2021-32669 | 5.4 | Jul 20 | TYPO3 is an open source PHP based web content management system Affected: 8.0.0 through 8.7.40; 9.0.0 through 9.5.28; 10.0.0 through 10.4.17; 11.0.0 through 11.3.0 |
| CVE-2021-32667 | 5.4 | Jul 20 | TYPO3 is an open source PHP based web content management system Affected: 9.0.0 through 9.5.287; 10.0.0 through 10.4.17; 11.0.0 through 11.3.0 |
| CVE-2021-21365 | 5.4 | Apr 27 | Bootstrap Package is a theme for TYPO3 Affected: before 7.1.2; 8.0.0 before 8.0.8; 9.0.0 before 9.0.4; 9.1.0 before 9.1.3; 10.0.0 before 10.0.10; 11.0.0 before 11.0.3 |
| CVE-2021-21370 | 5.4 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 7.0.0 before 7.6.51; 8.0.0 before 8.7.40; 9.0.0 before 9.5.25; 10.0.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2021-21358 | 5.4 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 10.2.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2021-21340 | 5.4 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 10.0.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2020-11065 | 5.4 | May 13 | In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by… Affected: 9.5.12 before 9.5.17; 10.2.0 before 10.4.2 |
| CVE-2020-11064 | 5.4 | May 13 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placeholder attributes… Affected: 9.0.0 before 9.5.17; 10.0.0 before 10.4.2 |
| CVE-2011-4632 | 5.4 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash… Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4631 | 5.4 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system… Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4630 | 5.4 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links… Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4629 | 5.4 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2010-3669 | 5.4 | Nov 4 | TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box Affected: 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3665 | 5.4 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |