Cross-site Scripting (XSS)

Overview nitsan/ns-backup is an extension for TYPO3 that lets you save your code, files, and database with just a few clicks. Install Backup Plus and connect it to your cloud storage like Google Drive, Dropbox, Amazon S3, SFTP, Rsync, etc.. Affected versions of this package are vulnerable to...

GHSA-463C-JHP2-4MM7 The Backup Plus extension for TYPO3 (ns_backup) allows command injections

The nsbackup extension through 13.0.0 for TYPO3 allows command injection when creating a backup. An authenticated backend user with access to the extensions backend module is required to exploit the vulnerability...

The Backup Plus extension for TYPO3 (ns_backup) allows command injections

The nsbackup extension through 13.0.0 for TYPO3 allows command injection when creating a backup. An authenticated backend user with access to the extensions backend module is required to exploit the vulnerability...

GHSA-JJWH-4X89-7F5W reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference

Insecure Direct Object Reference in the reintdownloadmanager TYPO3 extension allows remote attackers to read arbitrary files via the downloaduid parameter in the downloadAction...

reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference

Insecure Direct Object Reference in the reintdownloadmanager TYPO3 extension allows remote attackers to read arbitrary files via the downloaduid parameter in the downloadAction...

The femanager TYPO3 extension allows Insecure Direct Object Reference

Insecure Direct Object Reference IDOR in the femanager TYPO3 extension allows attackers to view frontend user data via a user parameter in the newAction of the newController...

GHSA-XXWR-WV9G-7JW3 The femanager TYPO3 extension allows Insecure Direct Object Reference

Insecure Direct Object Reference IDOR in the femanager TYPO3 extension allows attackers to view frontend user data via a user parameter in the newAction of the newController...

[clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the clickstorm SEO csseo TYPO3 extension allows backend users to execute arbitrary script via the JSON-LD output...

GHSA-6P8W-PC35-MQV8 [clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the clickstorm SEO csseo TYPO3 extension allows backend users to execute arbitrary script via the JSON-LD output...

CVE-2025-48206

The nsbackup extension through 13.0.0 for TYPO3 allows XSS...

CVE-2025-48207

The reintdownloadmanager extension through 5.0.0 for TYPO3 allows Insecure Direct Object Reference...

CVE-2025-48206

The nsbackup extension through 13.0.0 for TYPO3 allows XSS...

CVE-2025-48202

The femanager extension through 8.2.1 for TYPO3 allows Insecure Direct Object Reference...

CVE-2025-48205

The srfeuserregister extension through 12.4.8 for TYPO3 allows Insecure Direct Object Reference...

CVE-2025-48203

The csseo extension through 9.2.0 for TYPO3 allows XSS...

CVE-2025-48201

The nsbackup extension through 13.0.0 for TYPO3 has a Predictable Resource Location...

CVE-2025-48204

The nsbackup extension through 13.0.0 for TYPO3 allows command injection...

openjdk: Better TLS connection support (Oracle CPU 2025-04)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE:8u441, 8u441-perf, 11.0.26, 17.0.14, 21.0.6, 24; Oracle GraalVM for JDK:17.0.14, 21.0.6, 24; Oracle...

SUSE CVE-2025-37939

In the Linux kernel, the following vulnerability has been resolved: libbpf: Fix accessing BTF.ext corerelo header Update btfextparseinfo to ensure the corerelo header is present before reading its fields. This avoids a potential buffer read overflow reported by the OSS Fuzz project...

SUSE CVE-2025-37966

In the Linux kernel, the following vulnerability has been resolved: riscv: Fix kernel crash due to PRSETTAGGEDADDRCTRL When userspace does PRSETTAGGEDADDRCTRL, but Supm extension is not available, the kernel crashes: Oops - illegal instruction 1 snip epc : settaggedaddrctrl+0x112/0x15a ra :...