TYPO3 femanager extension allows remote frontend users to modify or delete records of other frontend users

The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors...

TYPO3 femanager 6.3.0 Cross Site Scripting Vulnerability

======================================================================= title: Stored Cross-Site Scripting vulnerability product: TYPO3 extension "femanager" vulnerable version: 6.0.0 - 6.3.0 and 5.5.0 and below fixed version: 6.3.1 and 5.5.1 CVE number: CVE-2021-36787 impact: Medium homepage:...

TYPO3 femanager 6.3.0 Cross Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Stored Cross-Site Scripting vulnerability product: TYPO3 extension "femanager" vulnerable version: 6.0.0 - 6.3.0 and 5.5.0 and below fixed version: 6.3.1 and 5.5.1 CVE...

Cross-site Scripting in the femanager TYPO3 extension

The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website. Note: If SVG uploads are required, it is recommended to use the TYPO3 extension...

GHSA-F3RF-V9QM-9C89 Cross-site Scripting in the femanager TYPO3 extension

The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website. Note: If SVG uploads are required, it is recommended to use the TYPO3 extension...

Cross-site Scripting (XSS)

femanageris vulnerable to Cross-site Scripting. The vulnerability exists due to insufficient sanitization of user-supplied data in the SVG image. A remote authenticated attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in...

TYPO3 Cross-Site Scripting Vulnerability (CNVD-2022-17974)

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Typo3 association in Switzerland.TYPO3 Femanager has a cross-site scripting vulnerability that can be exploited by attackers to XSS through a well-designed SVG document...

CVE-2021-36787

The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document...

CVE-2021-36787

The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document...

CVE-2021-36787

The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document...

CVE-2021-36787

The CVE-2021-36787 issue affects the TYPO3 femanager extension prior to 5.5.1 and 6.x prior to 6.3.1, where a crafted SVG document can trigger Cross-Site Scripting (XSS). The vulnerability arises from how SVG content is handled during user-related operations, allowing injected script when the SVG...

CVE-2021-36787

The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document...

TYPO3 跨站脚本漏洞

TYPO3 is a free and open source content management system framework CMS/CMF from the TYPO3 Typo3 association in Switzerland.TYPO3 Femanager has a cross-site scripting vulnerability that can be exploited by attackers to XSS through a well-designed SVG document...

Cross-Site Scripting in Extension "femanager" (femanager)

The extension allows by default to upload SVG files when a logged in frontend user uploads a new profile image. This may lead to Cross-Site Scripting, when the uploaded SVG image is used as is on the website...

CSRF in extension "femanager" (femanager)

The extension fails to implement a CSRF protection for edit and delete actions...

Multiple vulnerabilities in extension "femanager" (femanager)

It is possible to bypass configured server side validation rules which allows an attacker to create frontend user records with invalid data. Also, the eID script allows an attacker to set various validators using GET parameters resulting in information disclosure of field values from the feusers...

CVE-2014-6292

The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors...

Design/Logic Flaw

The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors...

CVE-2014-6292

The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors...

CVE-2014-6292

The CVE-2014-6292 entry affects the TYPO3 extension femanager (before 1.0.9). It allows a logged-in frontend user to modify or delete other frontend user records via unspecified vectors due to insufficient access checks. The advisory recommends upgrading to version 1.0.9 or later. Other connected...