REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

Summary A stored cross-site scripting XSS vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type's name field without HTML escaping. An attacker with...

CVE-2026-63179: Improper Limitation of a Pathname to a Restricted Directory

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, authenticated backend users can disclose arbitrary files readable by the PHP process by injecting @import inline directives into LESS source that the backend compiles, because the...

EUVD-2023-48265

Malicious code in bioql PyPI...

CVE-2023-43905

Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors...

TYPO3 Cross-Site Scripting in Online Media Asset Rendering

Failing to properly encode user input, online media asset rendering .youtube and .vimeo files is vulnerable to cross-site scripting. A valid backend user account or write access on the server system e.g. SFTP is needed in order to exploit this vulnerability...

PT-2024-40511 · Packagist · Typo3/Cms-Core

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned, so: Software affected versions not specified Description: A security issue allows backend users without read access to specific pages to still view them in the page tree, which should be disallowed...

Improper access control

Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors...

CVE-2023-43905

Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors...

CVE-2023-43905: Insufficiently Protected Credentials

Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors...

GHSA-HFM8-2Q22-H7HV Cross-site Scripting in pegasus/google-for-jobs

An XSS issue was discovered in the googleforjobs aka Google for Jobs extension before 1.5.1 and 2.x before 2.1.1 for TYPO3. The extension fails to properly encode user input for output in HTML context. A TYPO3 backend user account is required to exploit the vulnerability...

Vulnerabilities fixed in Typo3

The developers of Typo3 have fixed vulnerabilities in Typo3 Core. The vulnerabilities allow a malicious party to perform Perform cross-site scripting XSS attacks. Such attacks can lead to the execution of arbitrary script code in the context of the victim's browser. In order to perform such an...

GHSA-M2Q4-QGHH-P9CQ Server-Side Request Forgery in yoast_seo

The yoastseo aka Yoast SEO extension before 7.2.1 for TYPO3 allows SSRF via a backend user account...

Cross-Site Scripting in extension "Aimeos shop and e-commerce framework" (aimeos)

The extension fails to properly encode user input for output in HTML context. A valid backend user account with access to the Aimeos module is needed to exploit this vulnerability...

Security Misconfiguration in User Session Handling

When users change their password existing sessions for that particular user account are not revoked. A valid backend or frontend user account is required in order to make use of this vulnerability...