Arbitrary Code Injection

Overview typo3/cms is a free open source Content Management Framework. Affected versions of this package are vulnerable to Arbitrary Code Injection via the File Abstraction Layer FAL when renaming a file, by using unspecified characters in the file extension. Note: This is only exploitable if the...

CVE-2015-8758: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors...

CVE-2015-2289: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in templates/2k11/admin/entries.tpl in Serendipity before 2.0.1 allows remote authenticated editors to inject arbitrary web script or HTML via the serendipitycatname parameter to serendipityadmin.php, when creating a new category...