TY
Product
typo3
218
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 3High 35Medium 95Low 4
Watch
Add typo3 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-59020 | 6.5 | Jan 13 | TYPO3 CMS Allows Broken Access Control in Edit Document Controller Affected: 10.0.0 before 10.4.55; 11.0.0 before 11.5.49; 12.0.0 before 12.4.41; 13.0.0 before 13.4.23; 14.0.0 before 14.0.2 |
| CVE-2025-59018 | 6.5 | Sep 9 | Information Disclosure in Workspaces Module Affected: 9.0.0 before 9.5.55; 10.0.0 before 10.4.54; 11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 |
| CVE-2025-59015 | 6.5 | Sep 9 | Insufficient Entropy in Password Generation Affected: 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 |
| CVE-2025-7900 | 6.5 | Jul 22 | Insecure Direct Object Reference in extension "femanager" (femanager) Affected: through 6.4.1; 7.0.0 through 7.5.2; 8.0.0 through 8.3.0 |
| CVE-2024-55945 | 6.5 | Jan 14 | Cross-Site Request Forgery in DB Check Module in TYPO3 Affected: >= 11.0.0, < 11.5.42 |
| CVE-2024-25118 | 6.5 | Feb 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 8.0.0 before 8.7.57; 9.0.0 before 9.5.46; 10.0.0 before 10.4.43; 11.0.0 before 11.5.35; 12.0.0 before 12.4.11; 13.0.0 |
| CVE-2022-23501 | 6.5 | Dec 14 | TYPO3 is an open source PHP based web content management system Affected: before 8.7.49; 9.0.0 before 9.5.38; 10.0.0 before 10.4.33; 11.0.0 before 11.5.20; 12.0.0 before 12.1.1 |
| CVE-2022-31047 | 6.5 | Jun 14 | TYPO3 is an open source web content management system Affected: 7.0.0 before 7.6.57; 8.0.0 before 8.7.47; 9.0.0 before 9.5.35; 10.0.0 before 10.4.29; 11.0.0 before 11.5.11 |
| CVE-2021-32767 | 6.5 | Jul 20 | TYPO3 is an open source PHP based web content management system Affected: 7.0.0 through 7.6.51; 8.0.0 through 8.7.40; 9.0.0 through 9.5.27; 10.0.0 through 10.4.17; 11.0.0 through 11.3.0 |
| CVE-2011-4904 | 6.5 | Nov 6 | TYPO3 before 4.4.9 and 4.5.x before 4.5.4 does not apply proper access control on ExtDirect calls which allows remote attackers to retrieve ExtDirect endpoint services Affected: 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4902 | 6.5 | Nov 6 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4901 | 6.5 | Nov 6 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to extract arbitrary information from the TYPO3 database Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4900 | 6.5 | Nov 6 | TYPO3 before 4.5.4 allows Information Disclosure in the backend Affected: 4.5.0 before 4.5.4 |
| CVE-2011-4627 | 6.5 | Nov 6 | TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2010-3671 | 6.5 | Nov 5 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 is open to a session fixation attack which allows remote attackers to hijack a victim's session Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3664 | 6.5 | Nov 4 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Information Disclosure on the backend Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2025-59021 | 6.4 | Jan 13 | TYPO3 CMS Allows Broken Access Control in Redirects Module Affected: 10.0.0 before 10.4.55; 11.0.0 before 11.5.49; 12.0.0 before 12.4.41; 13.0.0 before 13.4.23; 14.0.0 before 14.0.2 |
| CVE-2025-59013 | 6.1 | Sep 9 | Open Redirect in TYPO3 CMS Affected: 9.0.0 before 9.5.55; 10.0.0 before 10.4.54; 11.0.0 before 11.5.48; 12.0.0 before 12.4.37; 13.0.0 before 13.4.18 |
| CVE-2024-55892 | 6.1 | Jan 14 | Potential Open Redirect via Parsing Differences in TYPO3 Affected: >= 9.0.0, < 9.5.49; >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3 |
| CVE-2023-47125 | 6.1 | Nov 14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 8.7.42 before 8.7.55; 9.5.29 before 9.5.44; 10.4.19 before 10.4.41; 11.3.2 before 11.5.33; 12.0.0 before 12.4.8 |
| CVE-2023-24814 | 6.1 | Feb 7 | TYPO3 is a free and open source Content Management Framework released under the GNU General Public License Affected: 8.7.0 before 9.7.51; 9.0.0 before 9.5.40; 10.0.0 before 10.4.36; 11.0.0 before 11.5.23; 12.0.0 before 12.2.0 |
| CVE-2022-36108 | 6.1 | Sep 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 10.0.0 through 10.4.31; 11.0.0 through 11.5.15 |
| CVE-2021-32768 | 6.1 | Aug 10 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 7.0.0 through 7.6.52; 8.0.0 through 8.7.41; 9.0.0 through 9.5.28; 10.0.0 through 10.4.18; 11.0.0 through 11.3.1 |
| CVE-2021-21338 | 6.1 | Mar 23 | TYPO3 is an open source PHP based web content management system Affected: 6.2.0 before 6.2.57; 7.0.0 before 7.6.51; 8.0.0 before 8.7.40; 9.0.0 before 9.5.25; 10.0.0 before 10.4.14; 11.0.0 before 11.1.1 |
| CVE-2020-26227 | 6.1 | Nov 23 | TYPO3 is an open source PHP based web content management system Affected: 6.2.0 before 6.2.54; 7.6.0 before 7.6.48; 8.7.0 before 8.7.38; 9.0.0 before 9.5.23; 10.0.0 before 10.4.10 |
| CVE-2020-15241 | 6.1 | Oct 8 | TYPO3 Fluid Engine (package `typo3fluid/fluid`) before versions 2.0.5, 2.1.4, 2.2.1, 2.3.5, 2.4.1, 2.5.5 or 2.6.1 is vulnerable to cross-site scripting when making use of the… Affected: 8.7.25; 9.5.6 |
| CVE-2020-8091 | 6.1 | Jan 27 | svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on a targeted system Affected: 6.2 before 6.2.39; 7.0.0 through 7.1.0 |
| CVE-2011-4903 | 6.1 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the RemoveXSS… Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2011-4626 | 6.1 | Nov 6 | Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary web script or HTML via the "JSwindow"… Affected: 4.3.0 before 4.3.12; 4.4.0 before 4.4.9; 4.5.0 before 4.5.4 |
| CVE-2010-3674 | 6.1 | Nov 5 | TYPO3 before 4.4.1 allows XSS in the frontend search box Affected: before 4.4.1 |
| CVE-2010-3672 | 6.1 | Nov 5 | TYPO3 before 4.3.4 and 4.4.x before 4.4.1 allows XSS in the textarea view helper in an extbase extension Affected: before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2010-3661 | 6.1 | Nov 1 | TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows Open Redirection on the backend Affected: before 4.1.14; 4.2.0 before 4.2.13; 4.3.0 before 4.3.4; 4.4.0 before 4.4.1 |
| CVE-2019-12748 | 6.1 | Jul 9 | TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS Affected: 8.3.0 through 8.7.26; 9.0.0 through 9.5.7 |
| CVE-2016-4056 | 6.1 | Jan 23 | Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module… Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +26 more |
| CVE-2015-8760 | 6.1 | Jan 8 | The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing." Affected: 6.2; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +23 more |
| CVE-2015-8757 | 6.1 | Jan 8 | Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers to inject arbitrary web script or HTML… Affected: 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; 6.2.0; +33 more |
| CVE-2025-47939 | 5.4 | May 20 | TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layer Affected: >= 9.0.0, < 9.5.51; >= 10.0.0, < 10.4.50; >= 11.0.0, < 11.5.44; >= 12.0.0, < 12.4.31; >= 13.0.0, < 13.4.12 |
| CVE-2024-55894 | 5.4 | Jan 14 | TYPO3 Cross-Site Request Forgery in Backend User Module Affected: >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3 |
| CVE-2024-55922 | 5.4 | Jan 14 | Cross-Site Request Forgery in Form Framework Module in TYPO3 Affected: >= 10.0.0, < 10.4.48; >= 11.0.0, < 11.5.42; >= 12.0.0, < 12.4.25; >= 13.0.0, < 13.4.3 |
| CVE-2024-34357 | 5.4 | May 14 | TYPO3 is an enterprise content management system Affected: 9.0.0 before 9.5.48; 10.0.0 before 10.4.45; 11.0.0 before 11.5.37; 12.0.0 before 12.4.15; 13.0.0 before 13.1.1 |
| CVE-2024-34356 | 5.4 | May 14 | TYPO3 is an enterprise content management system Affected: 9.0.0 before 9.5.48; 10.0.0 before 10.4.45; 11.0.0 before 11.5.37; 12.0.0 before 12.4.15; 13.0.0 before 13.1.1 |
| CVE-2024-34355 | 5.4 | May 14 | TYPO3 is an enterprise content management system Affected: 13.0.0 before 13.1.1 |
| CVE-2023-47127 | 5.4 | Nov 14 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 8.0.0 before 8.7.55; 9.0.0 before 9.5.44; 10.0.0 before 10.4.41; 11.0.0 before 11.5.33; 12.0.0 before 12.4.8 |
| CVE-2022-23502 | 5.4 | Dec 14 | TYPO3 is an open source PHP based web content management system Affected: 10.0.0 before 10.4.33; 11.0.0 before 11.5.20; 12.0.0 before 12.1.1 |
| CVE-2022-36107 | 5.4 | Sep 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 7.0.0 through 7.6.57; 8.0.0 through 8.7.47; 9.0.0 through 9.5.36; 10.0.0 through 10.4.31; 11.0.0 through 11.5.15 |
| CVE-2022-36106 | 5.4 | Sep 13 | TYPO3 is an open source PHP based web content management system released under the GNU GPL Affected: 10.0.0 through 10.4.31; 11.0.0 through 11.5.15 |
| CVE-2022-31049 | 5.4 | Jun 14 | TYPO3 is an open source web content management system Affected: 9.0.0 before 9.5.35; 10.0.0 before 10.4.29; 11.0.0 before 11.5.11 |
| CVE-2022-31048 | 5.4 | Jun 14 | TYPO3 is an open source web content management system Affected: 8.0.0 before 8.7.47; 9.0.0 before 9.5.35; 10.0.0 before 10.4.29; 11.0.0 before 11.5.11 |
| CVE-2021-32669 | 5.4 | Jul 20 | TYPO3 is an open source PHP based web content management system Affected: 8.0.0 through 8.7.40; 9.0.0 through 9.5.28; 10.0.0 through 10.4.17; 11.0.0 through 11.3.0 |
| CVE-2021-32667 | 5.4 | Jul 20 | TYPO3 is an open source PHP based web content management system Affected: 9.0.0 through 9.5.287; 10.0.0 through 10.4.17; 11.0.0 through 11.3.0 |