TYPO3 femanager 安全漏洞

TYPO3 femanager is a TYPO3 extension to the TYPO3 open source. A security vulnerability exists in TYPO3 femanager version 8.2.1 and earlier, which stems from the presence of an unsafe direct object reference...

Authorization Bypass Through User-Controlled Key

Overview in2code/femanager is a Modern TYPO3 Frontend User Registration. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the newAction function in NewController.php. An attacker can use an insecure direct object reference and view user data ...

PT-2025-22371

Name of the Vulnerable Software and Affected Versions femanager extension versions prior to 8.2.2 Description The issue allows attackers to view frontend user data. This is achieved through an Insecure Direct Object Reference IDOR in the femanager TYPO3 extension, where attackers can exploit a us...

TYPO3-EXT-SA-2025-006: Insecure Direct Object Reference in extension "femanager" (femanager)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-006...

PT-2023-31564 · Typo3 · Femanager Extension For Typo3

Name of the Vulnerable Software and Affected Versions: femanager Extension for TYPO3 affected versions not specified Description: A security bypass issue has been identified in the femanager Extension for TYPO3. Recommendations: At the moment, there is no information about a newer version that...

Broken Access Control in extension "femanager"

The extension fails to check access permissions for the edit user component. An authenticated frontend user can use the vulnerability to either edit data of various frontend users or to delete various frontend user accounts. Another missing access check in the backend module of the extensions...

GHSA-4XP5-HR35-84CX Broken Access Control in extension "femanager"

The extension fails to check access permissions for the edit user component. An authenticated frontend user can use the vulnerability to either edit data of various frontend users or to delete various frontend user accounts. Another missing access check in the backend module of the extensions...

TYPO3-EXT-SA-2023-010: Broken Access Control in extension "femanager" (femanager)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-010...

CVE-2022-44543

The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups if there is a usergroup field on the registration form. This occurs because the usergroup.inList protection mechanism is mishandled...

CVE-2022-44543

The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups if there is a usergroup field on the registration form. This occurs because the usergroup.inList protection mechanism is mishandled...

CVE-2022-44543

The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups if there is a usergroup field on the registration form. This occurs because the usergroup.inList protection mechanism is mishandled...

CVE-2022-44543

The CVE-2022-44543 issue affects the TYPO3 femanager extension (versions prior to 5.5.2, 6.x prior to 6.3.3, and 7.x prior to 7.0.1). The vulnerability arises from mishandling the usergroup.inList protection, enabling creation of frontend users in restricted groups when a usergroup field is prese...

CVE-2022-44543

The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups if there is a usergroup field on the registration form. This occurs because the usergroup.inList protection mechanism is mishandled...

Improper Access Control

femanager is vulnerable to Improper Access Control. The vulnerability is due to a lack of proper access control checks in the plugin, allowing a remote user to create frontend user accounts with unauthorized access to configured frontend groups...

TYPO3 extension femanager Broken Access Control vulnerability

femanager fails to check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can create frontend user accounts with access to configured frontend groups...

GHSA-93J4-V838-8767 TYPO3 extension femanager Broken Access Control vulnerability

femanager fails to check access permissions for the invitation component. Depending on the configuration of the plugin, a remote user can create frontend user accounts with access to configured frontend groups...

TYPO3-EXT-SA-2023-008: Broken Access Control in extension "femanager" (femanager)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2023-008...

The vulnerability of the femanager extension of the TYPO3 content management system allows a hacker to remove arbitrary users.

The vulnerability of the femanager extension of the TYPO3 content management system is related to the lack of access control in the InvitationController function. Exploiting this vulnerability could allow a malicious actor to delete arbitrary users remotely...

The vulnerability of the femanager extension of the TYPO3 content management system allows a hacker to set arbitrary passwords for users of the system.

The vulnerability of the femanager extension of the TYPO3 content management system is related to the lack of access control in the InvitationController. Exploiting this vulnerability allows a malicious actor to set arbitrary passwords for users of the system remotely...

Broken Access Control in 3rd party TYPO3 extension "femanager"

A missing access check in the InvitationController allows an unauthenticated user to delete all frontend users...