Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: TYPO3 CMS 10.4.54, 11.5.48 and 3 more versions Clear all filters
TI-2025-36661 CVE-2025-59018 · GHSA-w2pf-7q5w-2cgw

Information Disclosure in Workspaces Module

Priority LOW 31

Missing authorization checks in the Workspace Module of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke the corresponding AJAX ba…

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00294 Published 2025-09-09 Fixed in 9.5.55, 10.4.54 +3 CWE-200
TI-2025-36660 CVE-2025-59017 · GHSA-2fhw-2j7m-mr4m

Broken Access Control in Backend AJAX Routes

Priority LOW 24

Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allow backend users to directly invoke AJAX backend routes withou…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00303 Published 2025-09-09 Fixed in 9.5.55, 10.4.54 +3 CWE-862
TI-2025-36659 CVE-2025-59016 · GHSA-cvm2-5f78-g9m8

Information Disclosure via File Abstraction Layer

Priority LOW 24

Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full fi…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00235 Published 2025-09-09 Fixed in 9.5.55, 10.4.54 +3 CWE-209
TI-2025-36656 CVE-2025-59013 · GHSA-72jf-5fg5-3cw3

Open Redirect in TYPO3 CMS

Priority LOW 23

An open‑redirect vulnerability in GeneralUtility::sanitizeLocalUrl of TYPO3 CMS 9.0.0–9.5.54, 10.0.0–10.4.53, 11.0.0–11.5.47, 12.0.0–12.4.36, and 13.0.0–13.4.17 allows an attacker to redirect users to arbitrary external…

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00184 Published 2025-09-09 Fixed in 9.5.55, 10.4.54 +3 CWE-601