Design/Logic Flaw

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing...

Cross site scripting

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that content elements of type menu are vulnerable to cross-site scripting when their referenced items get previewed in the page module. A valid...

CVE-2021-21359 Denial of Service in Page Error Handling

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to ...

CVE-2021-21339

CVE-2021-21339 affects TYPO3, a PHP-based CMS. The issue is that user session identifiers were stored in cleartext in versions prior to 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, and 11.1.1. The root cause is storage of session identifiers without additional cryptographic hashing, and exploitation ...

CVE-2021-21340

TYPO3 core vulnerability CVE-2021-21340: In TYPO3 versions earlier than 10.4.14 and 11.1.1, database fields used as descriptionColumn could be exploited for cross-site scripting when content is previewed. A valid backend user is required to exploit. The issue is fixed in TYPO3 10.4.14 and 11.1.1....

CVE-2021-21340 Cross-Site Scripting in Content Preview

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 10.4.14, 11.1.1 it has been discovered that database fields used as descriptionColumn are vulnerable to cross-site scripting when their content gets previewed. A valid backend user account is needed to explo...

CVE-2021-21355

TYPO3 8.7.40, 9.5.25, 10.4.14, 11.1.1 fix a file-upload vulnerability where UploadedFileReferenceConverter can accept any mime-type for certain Extbase-based uploads, allowing attackers to place arbitrary files under /fileadmin/user_upload/ (and potentially reference/guess filenames). Impact stat...

CVE-2021-21357

TYPO3 Form Framework vulnerability (CVE-2021-21357): Improper input validation in Form Designer enables bypass of predefined option restrictions, allowing upload of arbitrary MIME types and persistence of files in writable TYPO3 directories. Requires a valid backend user to exploit. Affects TYPO3...

CVE-2021-21358

TYPO3 CMS is affected by a cross-site scripting (XSS) vulnerability in the Form Designer backend module of the Form Framework. The issue exists in TYPO3 versions before 10.4.14 and 11.1.1, and requires a valid backend user account with access to the Form module to exploit. It is fixed in versions...

CVE-2021-21338 Open Redirection in Login Handling

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 6.2.57, 7.6.51, 8.7.40, 9.5.25, 10.4.14, 11.1.1 it has been discovered that Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary content, and conducting phishing...

ShuipFCMS suffers from an arbitrary file write vulnerability (CNVD-2021-24708)

ShuipFCMS is a content management system based on ThinkPHP framework as the core and developed in an independent grouping approach. ShuipFCMS has an arbitrary file write vulnerability that can be exploited by attackers to gain server privileges...

TYPO3 Denial of Service Vulnerability (CNVD-2021-26142)

TYPO3 is a free and open source content management system. TYPO3 has a denial of service vulnerability that can be exploited by an attacker to conduct a denial of service attack on a page by requesting illegal or non-existent resources...

CmsEasy has an information leakage vulnerability

CmsEasy is a website content management system based on PHP+Mysql architecture and a PHP development platform. CmsEasy suffers from an information disclosure vulnerability. An attacker can exploit the vulnerability to obtain sensitive information...

The vulnerability of the Wireshark network traffic analyzer and CMS device allows a hacker to cause a service failure.

The vulnerability of the Wireshark network traffic analyzer’s CMS is related to the lack of initialization of resources. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

SQL Injection Vulnerability in LJCMS (CNVD-2021-22610)

LJCMS is a free and open source content management system. LJCMS suffers from a SQL injection vulnerability that can be exploited by attackers to obtain sensitive information about a database...

SQL Injection Vulnerability in zzphp 1.8.0 Backend

zzphp is a content management system. A SQL injection vulnerability exists in the zzzzphp 1.8.0 backend. An attacker can exploit this vulnerability to obtain sensitive information from the database...

XSS vulnerability in 115cms frontend (CNVD-2021-28389)

115CMS is developed using the current most popular ThinkPHP framework, which is an efficient and open source content management system. 115cms frontend has an XSS vulnerability that can be exploited by attackers to obtain user cookie information...

115CMS suffers from XSS vulnerability

115CMS is developed with ThinkPHP framework, which is an open source content management system. 115CMS suffers from an XSS vulnerability. An attacker can exploit the vulnerability to obtain an administrator cookie...

TYPO3 安全漏洞

TYPO3 is a free and open source content management system. TYPO3 has a denial of service vulnerability that can be exploited by an attacker to conduct a denial of service attack on a page by requesting illegal or non-existent resources...

Grav Path Traversal Vulnerability

Grav is a flat file CMS that uses Markdown files for content management. A path traversal vulnerability exists in the backup feature of Grav 1.7.0-rc.17 and earlier versions. An attacker can exploit this vulnerability to read arbitrary local files on the underlying server...