Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 - Local File Inclusion

Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 is susceptible to local file inclusion in public/examples/resources/getsource.php. This could allow remote attackers to read arbitrary files via the file parameter. id: CVE-2017-15363 info: name: Luracast Restler 3.0.1 via TYPO3 Restler 1.7.1 - Local...

TYPO3 ceselector Extension - Insecure Deserialization

TYPO3 extension contains a PHP Object Injection caused by passing attacker-controlled cookie to unserialize without validation, letting remote unauthenticated attackers achieve remote code execution, exploit requires Persistent Mode: Static configuration. id: CVE-2026-46725 info: name: TYPO3...

CVE-2018-6905

Installation and Execution Steps 0. Install type3 root@kitploit: $docker-compose up 1. Start and install typo3 web server Go to http://web-server ip:port/typo3 and ignore the following message: root@kitploit: Directory / is not writable Path /var/www/html/typo3 exists, but no file underneath it...

TYPO3-XSS-POC

TYPO3-XSS-POC Typo3 -v9.1.0 Persistent Cross Site ScriptingXSS Assigned CVE Number: CVE-2018-6905...

TYPO3-v7.6.15-Unencrypted-Login-Request

TYPO3-v7.6.15-Unencrypted-Login-Request TYPO3 v7.6.15 Unencrypted Login Request Assigned CVE Number: CVE-2017-6370...

CVE-2023-50460

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions userLogout, confirmUser, refuseUser, and resendUserConfirmation for any frontend user in the system...

CVE-2023-50459

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts...

CVE-2023-50462

An issue was discovered in the contentconsent aka Content Consent extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direc...

CVE-2023-50461

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...

CVE-2023-45023

The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component...

EUVD-2023-60688

An issue was discovered in the contentconsent aka Content Consent extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direc...

EUVD-2023-60667

The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component...

CVE-2023-50459

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts...

CVE-2023-50460

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions userLogout, confirmUser, refuseUser, and resendUserConfirmation for any frontend user in the system...

CVE-2023-50462

An issue was discovered in the contentconsent aka Content Consent extension through 2.0.1 for TYPO3. It fails to verify whether a specified content element identifier is permitted by the plugin. This enables an unauthenticated user to display various content elements, leading to an insecure direc...

CVE-2023-45023

The femanager extension 7 before 7.2.2 for TYPO3 has Incorrect Access Control: it lacks a check for permissions for the invitation component...

EUVD-2023-60687

An issue was discovered in the directmail aka Direct Mail extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration...

EUVD-2023-60686

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to perform various actions userLogout, confirmUser, refuseUser, and resendUserConfirmation for any frontend user in the system...

EUVD-2023-60685

An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. It fails to check access permissions for the edit user component. An authenticated frontend user can exploit this to either edit data of various frontend users or delete various frontend user accounts...

CVE-2023-50460

CVE-2023-50460 is an authorization bypass in the femanager extension 7.x before 7.2.3 for TYPO3 . The backend module fails to properly restrict actions, allowing an authenticated backend user to perform userLogout, confirmUser, refuseUser, and resendUserConfirmation on any frontend user in the sy...