GHSA-HQ37-RFJC-MR8H Cross-Site Scripting (XSS) in TYPO3 Backend

Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability...

Cross-Site Scripting (XSS) in TYPO3 Backend

Failing to properly encode user input, the page module is vulnerable to Cross-Site Scripting. A valid backend user account with permissions to edit plugins is needed to exploit this vulnerability...

Information Disclosure in TYPO3 Backend

The TYPO3 backend module stores the username of an authenticated backend user in its cache files. By guessing the file path to the cache files it is possible to receive valid backend usernames...

GHSA-VPR3-RC99-2WPR Information Disclosure in TYPO3 Backend

The TYPO3 backend module stores the username of an authenticated backend user in its cache files. By guessing the file path to the cache files it is possible to receive valid backend usernames...

Insecure Unserialize in TYPO3 Import/Export

Failing to properly validate incoming import data, the Import/Export component is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed...

GHSA-XVCP-33RC-J8GQ Insecure Unserialize in TYPO3 Import/Export

Failing to properly validate incoming import data, the Import/Export component is susceptible to insecure unserialize. To exploit this vulnerability a valid backend user account is needed...

Cross-Site Scripting in TYPO3 Backend

Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability...

GHSA-86R8-4G3W-7XJP Cross-Site Scripting in TYPO3 Backend

Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability...

Cross-Site Scripting in TYPO3 Backend

Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability...

GHSA-5WX6-XWXF-Q8QJ Cross-Site Scripting in TYPO3 Backend

Failing to properly encode user input, some backend components are vulnerable to Cross-Site Scripting. A valid backend user account is needed to exploit this vulnerability...

Authentication Bypass in TYPO3 CMS

The default authentication service misses to invalidate empty strings as password. Therefore it is possible to authenticate backend and frontend users without password set in the database. Note: TYPO3 does not allow to create user accounts without a password. Your TYPO3 installation might only be...

Typo3 Arbitrary File Disclosure in Form Component

Failing to properly validate user input, the form component is susceptible to Arbitrary File Disclosure. A valid backend user account is needed to exploit this vulnerability. Only forms are vulnerable, which contain upload fields...

GHSA-WRPF-2X8H-82GR Typo3 Arbitrary File Disclosure in Form Component

Failing to properly validate user input, the form component is susceptible to Arbitrary File Disclosure. A valid backend user account is needed to exploit this vulnerability. Only forms are vulnerable, which contain upload fields...

GHSA-3JXQ-5XHH-9JR3 Cross-Site Scripting (XSS) in TYPO3 component Backend

Failing to properly encode incoming data, the bookmark toolbar is susceptible to Cross-Site Scripting...

Cross-Site Scripting (XSS) in TYPO3 component Backend

Failing to properly encode incoming data, the bookmark toolbar is susceptible to Cross-Site Scripting...

Cross-Site Scripting (XSS)

typo3/cms-core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the mishandling of t3:// URL schemes and typolink functionality, which affecting both backend forms and frontend extensions using typolink rendering, which allows attackers to execute arbitrary JavaScript within...

Insecure Deserialization

typo3/cms-form is vulnerable to Insecure Deserialization. The vulnerability is due to the PECL package "yaml" with the PHP setting yml.decodephp enabled, which allows an attacker to deserialize arbitrary YAML to PHP code. An attacker must have a valid backend user account as well yaml.decodephp...

Cross-Site Scripting (XSS)

typo3/cms-core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper user input encoding of notifications shown in modal windows within the TYPO3 backend, which allows an attacker with a valid backend user account to execute arbitrary JavaScript in a users browser...

Cross-Site Scripting (XSS)

typo3/cms-core is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper user input encoding, which can result in XSS when rendering files from .youtube or .vimeo. Exploitation requires a valid backend user account or write access on the server system e.g., SFTP...

Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend

Failing to properly encode user input, several backend components are susceptible to Cross-Site Scripting, allowing authenticated editors to inject arbitrary HTML or JavaScript...