Cross site scripting

TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit...

Design/Logic Flaw

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This...

Code injection

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions...

CVE-2022-31050

TYPO3 Admin Tool sessions could remain valid after a user account was degraded or disabled, enabling prolonged access in the admin interface prior to the fixes. The vulnerability affects TYPO3 CMS and was addressed by updates in 9.5.34 ELTS, 10.4.29, and 11.5.11, per CVE-2022-31050 disclosures. T...

CVE-2022-31049

CVE-2022-31049 – TYPO3 Frontend Login Mailer XSS is a cross‑site scripting vulnerability in TYPO3. Prior to TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user-submitted content was not properly encoded in HTML emails sent to users, with the actual affected components being mail clients that v...

CVE-2022-31049 Cross-Site Scripting in Frontend Login Mailer

TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions...

CVE-2022-31046

TYPO3 Information Disclosure via Export Module (CVE-2022-31046): The export feature could leak internal details by not limiting the result set to allowed columns. Affected TYPO3 versions include 7.6.57 ELTS, 8.7.47 ELTS, 9.5.35 ELTS, 10.4.29, and 11.5.11. Remediation: upgrade to the fixed release...

CVE-2022-31047 Insertion of Sensitive Information into Log File in typo3/cms-core

TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys e.g. database credentials can be logged as plaintext in exception handlers, when logging the complete exception stack trace...

CVE-2022-31047

CVE-2022-31047 affects TYPO3: prior to 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials (e.g., database credentials) could be logged as plaintext in exception handlers when logging complete stack traces. A fix was released in the listed versions. Practical ...

CVE-2021-41663

A cross-site scripting XSS vulnerability exists in Mini CMS V1.11. The vulnerability exists in the article upload: post-edit.php page...

CVE-2021-44117

A Cross Site Request Forgery CSRF vulnerability exists in TheDayLightStudio Fuel CMS 1.5.0 via a POST call to /fuel/sitevariables/delete/4...

ZZCMS SQL Injection Vulnerability (CNVD-2022-56479)

ZZCMS is a content management system CMS from the ZZCMS team in China. zzCMS version 2019 is vulnerable to SQL injection, which stems from the lack of security filtering of the id parameter in /dl/dlprint.php. No detailed vulnerability details are provided at this time...

ZZCMS SQL Injection Vulnerability (CNVD-2022-56481)

ZZCMS is a content management system CMS by the ZZCMS team in China. zzCMS version 2019 is vulnerable to SQL injection, which stems from the lack of single quotes in the id parameter of /admin/dlsendsms.php. No detailed vulnerability details are currently available...

ZZCMS SQL Injection Vulnerability (CNVD-2022-56480)

ZZCMS is a content management system CMS from the ZZCMS team in China. zzCMS version 2019 is vulnerable to SQL injection, which stems from the lack of security filtering of the id parameter in /dl/dldownload.php. No detailed vulnerability details are provided at this time...

Elitecms arbitrary code execution vulnerability

Elitecms is a web content management from elitecms India. elitecms 1.01 has an arbitrary code execution vulnerability that can be exploited by attackers to execute arbitrary code attacks via admin/manageuploads.php...

Elitecms SQL Injection Vulnerability (CNVD-2022-57759)

Elitecms is a Web content management from elitecms India. elitecms version 1.01 has a SQL injection vulnerability that originates from the lack of validation of external input SQL statements on the /admin/addpost.php page, which can be exploited by attackers to execute illegal SQL commands to ste...

TPCMS arbitrary file upload vulnerability

TPCMS, an open source content management system from the individual developers of Source of Happiness, is vulnerable to an arbitrary file upload vulnerability in version v3.2, which stems from a lack of validation of uploaded files by the application. An attacker could exploit this vulnerability ...

Elitecms arbitrary file deletion vulnerability

Elitecms is a web content management from elitecms India. elitecms version 1.01 has an arbitrary file deletion vulnerability that can be exploited by attackers to delete any file...

Elitecms SQL Injection Vulnerability (CNVD-2022-57763)

Elitecms is a Web content management by elitecms India. elitecms version 1.01 has a SQL injection vulnerability that originates from the admin/editpost.php page's lack of validation of external input SQL statements, which can be exploited by attackers to execute illegal SQL commands to steal...

BrowsBox CMS SQL Injection Vulnerability

BrowsBox CMS is a content management system from BrowsBox Belgium. v4.0 of BrowsBox CMS is vulnerable to SQL injection, which can be exploited by attackers to execute illegal SQL commands to steal sensitive database data...