Priority LOW 31
Changing backend users' passwords via the user settings module results in storing the cleartext password in the uc and user_settings fields of the be_users database table.
CVSS 4.0HIGH 7.3· Network · No auth · User interaction · EPSS 0.00167 · Published 2026-04-21 · Fixed in 14.3.0 CWE-312
Priority LOW 23
TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code executi…
CVSS 4.0MEDIUM 5.2· Local · Low privileges · No interaction · EPSS 0.00184 · Published 2026-01-13 · Fixed in 10.4.55, 11.5.49 +3 CWE-502
Priority LOW 31
Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table.
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00417 · Published 2026-01-13 · Fixed in 10.4.55, 11.5.49 +3 CWE-862
Priority LOW 24
Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record without restriction to the user’s own file-mounts or web-mounts.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00268 · Published 2026-01-13 · Fixed in 10.4.55, 11.5.49 +3 CWE-862
Priority LOW 24
By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00312 · Published 2026-01-13 · Fixed in 10.4.55, 11.5.49 +3 CWE-863
Priority LOW 24
Missing authorization checks in the CSV download feature of TYPO3 CMS versions 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to disclose information from arbitrary database tables stored within t…
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00235 · Published 2025-09-09 · Fixed in 12.4.37, 13.4.18 +1 CWE-200
Priority LOW 31
Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX ba…
CVSS 4.0HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00294 · Published 2025-09-09 · Fixed in 9.5.55, 10.4.54 +3 CWE-200
Priority LOW 24
Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes withou…
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00303 · Published 2025-09-09 · Fixed in 9.5.55, 10.4.54 +3 CWE-862
Priority LOW 24
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full fi…
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00235 · Published 2025-09-09 · Fixed in 9.5.55, 10.4.54 +3 CWE-209
Priority LOW 27
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00187 · Published 2025-09-09 · Fixed in 12.4.37, 13.4.18 CWE-331
Priority LOW 23
An uncaught exception in the Bookmark Toolbar of TYPO3 CMS versions 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 lets administrator‑level backend users trigger a denial‑of‑service condition in the backend user inte…
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.0029 · Published 2025-09-09 · Fixed in 11.5.48, 12.4.37 +1 CWE-248
Priority LOW 23
An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external…
CVSS 4.0MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00184 · Published 2025-09-09 · Fixed in 9.5.55, 10.4.54 +3 CWE-601
Priority LOW 24
The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata.
CVSS 4.0MEDIUM 5.3· Network · Low privileges · No interaction · EPSS 0.00251 · Published 2025-07-22 · Fixed in 6.4.2, 7.5.3 +1 CWE-639
Priority LOW 34
TYPO3 is an open source, PHP based web content management system.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00469 · Published 2025-05-20 · Fixed in 12.4.31, 13.4.12 CWE-288
Priority LOW 34
TYPO3 is an open source, PHP based web content management system.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00456 · Published 2025-05-20 · Fixed in 10.4.50, 11.5.44 +2 CWE-283
Priority LOW 24
TYPO3 is an open source, PHP based web content management system.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00181 · Published 2025-05-20 · Fixed in 9.5.51, 10.4.50 +3 CWE-351
Priority LOW 18
TYPO3 is an open source, PHP based web content management system.
CVSS 3.1LOW 3.8· Network · High privileges · No interaction · EPSS 0.00278 · Published 2025-05-20 · Fixed in 9.5.51, 10.4.50 +3 CWE-620
Priority LOW 24
TYPO3 is an open source, PHP based web content management system.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00301 · Published 2025-05-20 · Fixed in 9.5.51, 10.4.50 +3 CWE-863
Priority LOW 20
TYPO3 is an open source, PHP based web content management system.
CVSS 3.1MEDIUM 4.4· Network · High privileges · No interaction · EPSS 0.00274 · Published 2025-05-20 · Fixed in 12.4.31, 13.4.12 CWE-918
Priority LOW 27
TYPO3 is a free and open source Content Management Framework.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00249 · Published 2025-01-14 · Fixed in 9.5.49, 10.4.48 +3 CWE-601
Priority LOW 20
TYPO3 is a free and open source Content Management Framework.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00251 · Published 2025-01-14 · Fixed in 10.4.48, 11.5.42 +2 CWE-352
Priority LOW 24
TYPO3 is a free and open source Content Management Framework.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00251 · Published 2025-01-14 · Fixed in 10.4.48, 11.5.42 +2 CWE-352
Priority LOW 19
TYPO3 is a free and open source Content Management Framework.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00201 · Published 2025-01-14 · Fixed in 10.4.48, 11.5.42 +2 CWE-352
Priority MEDIUM 40
TYPO3 is a free and open source Content Management Framework.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00368 · Published 2025-01-14 · Fixed in 10.4.48, 11.5.42 +2 CWE-352
Priority LOW 24
TYPO3 is a free and open source Content Management Framework.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.00198 · Published 2025-01-14 · Fixed in 10.4.48, 11.5.42 +2 CWE-352
Load more
THREATIST.IORead the docs