Priority MEDIUM 55
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status move message handling.
CVSS 4.0MEDIUM 4.8· Network · Low privileges · User interaction · EPSS 0.00234 · Published 2026-01-14 · No fix listed CWE-79
Priority MEDIUM 55
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status functionality.
CVSS 4.0MEDIUM 4.8· Network · Low privileges · User interaction · EPSS 0.00234 · Published 2026-01-14 · No fix listed CWE-79
Priority LOW 22
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component.
CVSS 4.0MEDIUM 4.8· Network · Low privileges · User interaction · EPSS 0.00234 · Published 2026-01-14 · No fix listed CWE-79
Priority LOW 39
TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00553 · Published 2022-03-25 · No fix listed CWE-352
Priority LOW 29
Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes,
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00826 · Published 2021-06-21 · No fix listed CWE-79
Priority LOW 23
Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00702 · Published 2020-12-11 · No fix listed CWE-79
Priority MEDIUM 48
Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.15578 · Published 2020-09-19 · No fix listed CWE-434
Priority LOW 20
The Typesetter CMS 5.1 logout functionality is affected by a CSRF vulnerability.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00409 · Published 2020-01-05 · No fix listed CWE-352
Priority LOW 23
index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.0067 · Published 2019-05-13 · No fix listed CWE-79
Priority LOW 23
index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.0067 · Published 2019-05-13 · No fix listed CWE-79
Priority LOW 26
Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation.
CVSS 3.0MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00684 · Published 2019-05-13 · No fix listed CWE-79
Priority LOW 23
include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS.
CVSS 3.0MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00734 · Published 2019-05-09 · No fix listed CWE-79
Priority MEDIUM 48
An issue was discovered in Typesetter 5.1.
CVSS 3.0HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.06692 · Published 2018-02-12 · No fix listed CWE-94
Priority LOW 39
An issue was discovered in Typesetter 5.1.
CVSS 3.0HIGH 8.0· Network · Low privileges · User interaction · EPSS 0.01926 · Published 2018-02-12 · No fix listed CWE-352
THREATIST.IORead the docs