WS-2019-0006

TYPO3 in versions 8.x before 8.7.21 and 9.x before 9.5.2 It has been discovered, that the third party library CKEditor is vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability...

Cross-Site Scripting in Online Media Asset Rendering

Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...

Cross-Site Scripting in CKEditor

It has been discovered, that the third party library CKEditor is vulnerable to cross-site scripting. A valid backend user account is needed in order to exploit this vulnerability...

typo3 -- multiple vulnerabilities

Typo3 core team reports: CKEditor 4.11 fixes an XSS vulnerability in the HTML parser reported by maxarr. The vulnerability stemmed from the fact that it was possible to execute XSS inside the CKEditor source area after persuading the victim to: i switch CKEditor to source mode, then ii paste a...

CVE-2018-14971

An issue was discovered in QCMS 3.0.1. upload/System/Controller/backend/user.php has XSS...

CVE-2018-14978: Cross-Site Request Forgery (CSRF)

An issue was discovered in QCMS 3.0.1. CSRF exists via the backend/user/admin/add.html URI...

PT-2018-12855

Name of the Vulnerable Software and Affected Versions QCMS version 3.0.1 Description An issue exists where CSRF is possible via the "backend/user/admin/add.html" API endpoint. Recommendations For QCMS version 3.0.1, consider implementing proper CSRF protection mechanisms to prevent exploitation. ...

Insecure Deserialization in TYPO3 CMS

It has been discovered that the Form Framework system extension "form" is vulnerable to Insecure Deserialization when being used with the additional PHP PECL package “yaml”, which is capable of unserializing YAML contents to PHP objects. A valid backend user account as well as having PHP setting...

TYPO3 Backend Cross-Site Scripting Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. A cross-site scripting vulnerability exists in the TYPO3 backend. Because the program fails to properly encode user input, an attacker would need to use a valid backend user...

Insecure Unserialize and SQL Injection in extension "Code Highlighter" (mh_code_highlighter)

It has been discovered that the extension "Code Highlighter" mhcodehighlighter is susceptible to Insecure Unserialize and SQL Injection. Release Date: November 14, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: versio...

Insecure Unserialize in TYPO3 Import/Export

It has been discovered, that TYPO3 is susceptible to Insecure Unserialize. Component Type: TYPO3 CMS Release Date: July 19, 2016 Vulnerable subcomponent: Import/Export Vulnerability Type: Insecure Unserialize Affected Versions: Versions 6.2.0 to 6.2.25, 7.6.0 to 7.6.9 and 8.0.0 to 8.2.0 Severity:...

phpwcms <= 1.5.4.6 "preg_replace" - Multiple Vulnerabilities

No description provided by source. ?php / phpwcms = v1.5.4.6 pregreplace remote code execution exploit vendor: http://www.phpwcms.de/ Download: github.com/slackero/phpwcms by: aeon Well it appears there are multiple remote code execution bugs that exists in phpwcms for quite some time now. Here I...

TYPO3 Backend User Administration Cross Site Scripting Vulnerability

TYPO3 is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:typo3:typo3";...

UBUNTU-CVE-2013-7077

Cross-site scripting XSS vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

PT-2013-6260

Name of the Vulnerable Software and Affected Versions TYPO3 versions 6.0.x through 6.0.11 TYPO3 versions 6.1.x through 6.1.6 Description A cross-site scripting XSS issue exists in the Backend User Administration Module, allowing remote attackers to inject arbitrary web script or HTML...

CVE-2013-7077

Cross-site scripting XSS vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2013-7077: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Backend User Administration Module in TYPO3 6.0.x before 6.0.12 and 6.1.x before 6.1.7 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

TYPO3后端用户管理反射型跨站脚本漏洞

TYPO3是一款基于PHP4/PHP5+MYsql的内容管理系统。 TYPO3后端用户管理Backend User Administration存在反射型跨站脚本漏洞，允许远程攻击者利用漏洞构建恶意URI，诱使用户解析，当恶意数据被查看时可获取敏感信息或者劫持用户会话。 0 TYPO3 6.0.0 TYPO3 6.0.11 TYPO3 6.1.0 TYPO3 6.1.6 TYPO3 6.2 厂商补丁： TYPO3 ----- TYPO3 4.5.32, 4.7.17, 6.0.12, 6.1.7已经修复该漏洞，请到厂商的主页下载： http://typo3.org/...

phpwcms 1.5.4.6 Remote Code Execution

?php / phpwcms = v1.5.4.6 "pregreplace" remote code execution exploit vendor: http://www.phpwcms.de/ Download: github.com/slackero/phpwcms by: aeon Well it appears there are multiple remote code execution bugs that exists in phpwcms for quite some time now. Here I will exploit one of them, but ma...

phpwcms <= v1.5.4.6 "preg_replace" Multiple Vulnerabilities

Exploit for php platform in category web applications ?php / phpwcms = v1.5.4.6 "pregreplace" remote code execution exploit vendor: http://www.phpwcms.de/ Download: github.com/slackero/phpwcms by: aeon Well it appears there are multiple remote code execution bugs that exists in phpwcms for quite...