TY
Product
typo3
220
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 4High 35Medium 96Low 4
Watch
Add typo3 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-21365 | 5.4 | Apr 27 | Bootstrap Package is a theme for TYPO3 Affected: before 7.1.2; 8.0.0 before 8.0.8; 9.0.0 before 9.0.4; 9.1.0 before 9.1.3; 10.0.0 before 10.0.10; 11.0.0 before 11.0.3 |
| CVE-2021-21370 | 5.4 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 7.0.0 before 7.6.51; 8.0.0 before 8.7.40; 9.0.0 before 9.5.25; 10.0.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2021-21358 | 5.4 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 10.2.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2021-21340 | 5.4 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 10.0.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2020-11065 | 5.4 | May 13 | In TYPO3 CMS greater than or equal to 9.5.12 and less than 9.5.17, and greater than or equal to 10.2.0 and less than 10.4.2, it has been discovered that link tags generated by… Affected: 9.5.12 before 9.5.17; 10.2.0 before 10.4.2 |
| CVE-2020-11064 | 5.4 | May 13 | In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.17 and greater than or equal to 10.0.0 and less than 10.4.2, it has been discovered that HTML placeholder attributes… Affected: 9.0.0 before 9.5.17; 10.0.0 before 10.4.2 |
| CVE-2011-4632 | 5.4 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the tcemain flash… Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4631 | 5.4 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the system… Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4630 | 5.4 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the browse_links… Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4629 | 5.4 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the admin panel Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2010-3669 | 5.4 | Nov 4 | TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS and Open Redirection in the frontend login box Affected: 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3665 | 5.4 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the Extension Manager Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3660 | 5.4 | Nov 1 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows XSS on the backend Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3659 | 5.4 | Oct 20 | Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated… Affected: 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; +26 more |
| CVE-2015-8759 | 5.4 | Jan 8 | Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web… Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +33 more |
| CVE-2015-8758 | 5.4 | Jan 8 | Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to… Affected: 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +33 more |
| CVE-2015-8756 | 5.4 | Jan 8 | Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed_search) component in TYPO3 6.2.x before 6.2.16 allows remote authenticated… Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +23 more |
| CVE-2015-8755 | 5.4 | Jan 8 | Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to… Affected: 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +33 more |
| CVE-2025-47937 | 5.3 | May 20 | TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handling Affected: >= 9.0.0, < 9.5.51; >= 10.0.0, < 10.4.50; >= 11.0.0, < 11.5.44; >= 12.0.0, < 12.4.31; >= 13.0.0, < 13.4.12 |
| CVE-2024-55891 | 5.3 | Jan 14 | Information Disclosure via Exception Handling/Logger in TYPO3 Affected: < 13.4.3 |
| CVE-2024-45232 | 5.3 | Aug 28 | An issue was discovered in powermail extension through 12.3.5 for TYPO3 Affected: before 12.4.0 |
| CVE-2024-34358 | 5.3 | May 14 | TYPO3 is an enterprise content management system Affected: 9.0.0 before 9.5.48; 10.0.0 before 10.4.45; 11.0.0 before 11.5.37; 12.0.0 before 12.4.15; 13.0.0 before 13.1.1 |
| CVE-2023-47126 | 5.3 | Nov 14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 12.2.0 before 12.4.8 |
| CVE-2023-38499 | 5.3 | Jul 25 | TYPO3 is an open source PHP based web content management system Affected: 9.4.0 before 9.5.42; 10.0.0 before 10.4.39; 11.0.0 before 11.5.30; 12.0.0 before 12.4.4 |
| CVE-2022-36105 | 5.3 | Sep 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 7.0.0 through 7.6.57; 8.0.0 through 8.7.47; 9.0.0 through 9.5.36; 10.0.0 through 10.4.31; 11.0.0 through 11.5.15 |
| CVE-2021-41114 | 5.3 | Oct 5 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 11.0.0 before 11.5.0 |
| CVE-2010-3673 | 5.3 | Nov 5 | TYPO3 before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows information disclosure in the mail header of the HTML mailing API Affected: 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3667 | 5.3 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Spam Abuse in the native form content element Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3666 | 5.3 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness in the uniqid function Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2017-6370 | 5.3 | Mar 17 | TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by… Affected: 7.6.15 |
| CVE-2024-34537 | 4.9 | Oct 28 | TYPO3 before 13.3.1 allows denial of service (interface error) in the Bookmark Toolbar (ext:backend), exploitable by an administrator-level backend user account via manipulated… Affected: 10.0.0 before 10.4.46; 11.0.0 before 11.5.40; 12.0.0 before 12.4.21; 13.0.0 before 13.3.1 |
| CVE-2024-25119 | 4.9 | Feb 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 8.0.0 before 8.7.57; 9.0.0 before 9.5.46; 10.0.0 before 10.4.43; 11.0.0 before 11.5.35; 12.0.0 before 12.4.11; 13.0.0 |
| CVE-2023-30451 | 4.9 | Dec 25 | In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as… Affected: 11.5.24 |
| CVE-2022-23504 | 4.9 | Dec 14 | TYPO3 is an open source PHP based web content management system Affected: 9.0.0 before 9.5.38; 10.0.0 before 10.4.33; 11.0.0 before 11.5.20; 12.0.0 before 12.1.1 |
| CVE-2021-32668 | 4.8 | Jul 20 | TYPO3 is an open source PHP based web content management system Affected: 8.0.0 through 8.7.40; 9.0.0 through 9.5.28; 10.0.0 through 10.4.17; 11.0.0 through 11.3.0 |
| CVE-2010-3670 | 4.8 | Nov 5 | TYPO3 before 4.3.4 and 4.4.x before 4.4.1 contains insecure randomness during generation of a hash with the "forgot password" function Affected: before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2018-6905 | 4.8 | Apr 8 | The page module in TYPO3 before 8.7.11, and 9.1.0, has XSS via $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'], as demonstrated by an admin entering a crafted site name during the… Affected: before 8.7.11; 9.0.0 before 9.1.0 |
| CVE-2025-47936 | 4.4 | May 20 | TYPO3 Vulnerable to Server Side Request Forgery via Webhooks Affected: >= 12.0.0, < 12.4.31; >= 13.0.0, < 13.4.12 |
| CVE-2025-59019 | 4.3 | Sep 9 | Information Disclosure via CSV Download Affected: 11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 |
| CVE-2025-59016 | 4.3 | Sep 9 | Information Disclosure via File Abstraction Layer Affected: 9.0.0 before 9.5.55; 10.0.0 through 10.4.54; 11.0.0 through 11.5.48; 12.0.0 through 12.4.37; 13.0.0 through 13.4.18 |
| CVE-2024-55893 | 4.3 | Jan 14 | TYPO3 Cross-Site Request Forgery in Log Module Affected: >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3 |
| CVE-2024-55920 | 4.3 | Jan 14 | Cross-Site Request Forgery in Dashboard Module in TYPO3 Affected: >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3 |
| CVE-2024-55923 | 4.3 | Jan 14 | Cross-Site Request Forgery in Indexed Search Module in TYPO3 Affected: >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3 |
| CVE-2024-47780 | 4.3 | Oct 8 | Information Disclosure in TYPO3 Page Tree Affected: >= 10.0.0, < 10.4.46; >= 11.0.0, < 11.5.40; >= 12.0.0, < 12.4.21; >= 13.0.0, < 13.3.1 |
| CVE-2024-25120 | 4.3 | Feb 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 8.0.0 before 8.7.57; 9.0.0 before 9.5.46; 10.0.0 before 10.4.43; 11.0.0 before 11.5.35; 12.0.0 before 12.4.11; 13.0.0 |
| CVE-2022-31046 | 4.3 | Jun 14 | TYPO3 is an open source web content management system Affected: 7.0.0 before 7.6.57; 8.0.0 before 8.7.47; 9.0.0 before 9.5.35; 10.0.0 before 10.4.29; 11.0.0 before 11.5.11 |