Command Injection

Overview nitsan/ns-backup is an extension for TYPO3 that lets you save your code, files, and database with just a few clicks. Install Backup Plus and connect it to your cloud storage like Google Drive, Dropbox, Amazon S3, SFTP, Rsync, etc.. Affected versions of this package are vulnerable to...

GHSA-463C-JHP2-4MM7 The Backup Plus extension for TYPO3 (ns_backup) allows command injections

The nsbackup extension through 13.0.0 for TYPO3 allows command injection when creating a backup. An authenticated backend user with access to the extensions backend module is required to exploit the vulnerability...

GHSA-6P8W-PC35-MQV8 [clickstorm] SEO (cs_seo) TYPO3 extension Cross-site Scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in the clickstorm SEO csseo TYPO3 extension allows backend users to execute arbitrary script via the JSON-LD output...

CVE-2025-5010

A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the component Blog Backend. The manipulation of the argument Description leads to cross site scripting. It is possible to initiate the attack...

CVE-2025-5010

A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the component Blog Backend. The manipulation of the argument Description leads to cross site scripting. It is possible to initiate the attack...

CVE-2025-5010 moonlightL hexo-boot Blog Backend index.html cross site scripting

A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the component Blog Backend. The manipulation of the argument Description leads to cross site scripting. It is possible to initiate the attack...

CVE-2025-5010 moonlightL hexo-boot Blog Backend index.html cross site scripting

A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the component Blog Backend. The manipulation of the argument Description leads to cross site scripting. It is possible to initiate the attack...

CVE-2024-55894

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

CVE-2024-55893

TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery CSRF. Additionally, state-changing actions in downstrea...

The TYPO3 CMS Backend has Broken Authentication in Backend MFA

Problem The multifactor authentication MFA dialog presented during backend login can be bypassed due to insufficient enforcement of access restrictions on all backend routes. Successful exploitation requires valid backend user credentials, as MFA can only be bypassed after successful...

GHSA-744G-7QM9-HJH9 The TYPO3 CMS Backend has Broken Authentication in Backend MFA

Problem The multifactor authentication MFA dialog presented during backend login can be bypassed due to insufficient enforcement of access restrictions on all backend routes. Successful exploitation requires valid backend user credentials, as MFA can only be bypassed after successful...

TYPO3 Unverified Password Change for Backend Users

Problem The backend user management interface allows password changes without requiring the current password. When an administrator updates their own account or modifies other user accounts via the admin interface, the current password is not requested for verification. This behavior may lower th...

GHSA-3JRG-97F3-RQH9 TYPO3 Unverified Password Change for Backend Users

Problem The backend user management interface allows password changes without requiring the current password. When an administrator updates their own account or modifies other user accounts via the admin interface, the current password is not requested for verification. This behavior may lower th...

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel due to insufficient enforcement of access restrictions on all backend routes. An attacker can bypass the multifactor authentication MFA dialog presented during backend login by...

Unverified Password Change

Overview typo3/cms-setup is an Allows users to edit a limited set of options for their user profile, including preferred language, their name and email address. Affected versions of this package are vulnerable to Unverified Password Change through the backend user management interface. An attacke...

Server-side Request Forgery (SSRF)

Overview typo3/cms-webhooks is a Handle outgoing Webhooks for TYPO3 Affected versions of this package are vulnerable to Server-side Request Forgery SSRF. An attacker can manipulate internal resources by sending crafted requests from a compromised or malicious external site. This is only exploitab...

CVE-2025-47941

TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, the multifactor authentication MFA dialog presented during backend login can be bypassed due to insufficient enforcement of access...

CVE-2025-47941 TYPO3 Has Broken Authentication in Backend MFA

TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, the multifactor authentication MFA dialog presented during backend login can be bypassed due to insufficient enforcement of access...

CVE-2025-47941 TYPO3 Has Broken Authentication in Backend MFA

TYPO3 is an open source, PHP based web content management system. In versions on the 12.x branch prior to 12.4.31 LTS and the 13.x branch prior to 13.4.2 LTS, the multifactor authentication MFA dialog presented during backend login can be bypassed due to insufficient enforcement of access...

CVE-2025-47941

The TYPO3 CVE-2025-47941 vulnerability affects TYPO3 CMS where the MFA dialog during backend login can be bypassed due to insufficient enforcement of access restrictions on backend routes. Exploitation requires valid backend credentials and MFA can be bypassed after authentication. Affected versi...