Origin Validation Error

Overview typo3/cms-install is a TYPO3 extension install. The Install Tool is used for installation, upgrade, system administration and setup tasks. Affected versions of this package are vulnerable to Origin Validation Error via referrer enforcement in the ReferrerEnforcer code used by the backend...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via referrer enforcement in the ReferrerEnforcer code used by the backend and Install Tool. An attacker can invoke protected backend or Install Tool endpoints with an authenticated victim’s session by sending...

Origin Validation Error

Overview typo3/cms-core is a free open source enterprise content management system. Affected versions of this package are vulnerable to Origin Validation Error via referrer enforcement in the ReferrerEnforcer code used by the backend and Install Tool. An attacker can invoke protected backend or...

TYPO3-CORE-SA-2026-021: Broken Access Control in Backend and Install Tool

More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-021...

CVE-2026-19418

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

CVE-2026-19418 TYPO3 CMS - Broken Access Control in Backend and Install Tool

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

CVE-2026-19418 TYPO3 CMS - Broken Access Control in Backend and Install Tool

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

CVE-2026-19418

TYPO3 CMS contains a Broken Access Control in Backend and Install Tool for versions 13.0.0-13.4.33 and 14.0.0-14.3.5. Root cause: referrer enforcement from TYPO3 core SA-2020-006 became ineffective in v13.0+ because the backend/install tooling are served from the site’s main entry script rather t...

EUVD-2026-55971

The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 CVE-2020-11069 became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend and Install Tool applications from the site's main entry script instead of the dedicated typo3/ directory. Whether a request originated fro...

PT-2026-70078

Name of the Vulnerable Software and Affected Versions TYPO3 CMS versions 13.0.0 through 13.4.33 TYPO3 CMS versions 14.0.0 through 14.3.5 Description Referrer enforcement became ineffective because the backend and Install Tool applications are served from the site's main entry script rather than a...

CVE-2026-59193 Grav CMS — Improper Handling of Highly Compressed Data in Installer::unZip()

Grav is a file-based Web platform. Prior to 2.0.0, an authenticated admin.super user can crash Grav or fill the disk by uploading a specially crafted ZIP archive through the Direct Install tool because Installer::unZip calls ZipArchive::extractTo without limits on uncompressed size, entry count, ...

CVE-2026-59193

Grav CMS is a file-based web platform. Before version 2.0.0, an authenticated admin.super user could trigger a denial of service by uploading a specially crafted ZIP via the Direct Install tool, because Installer::unZip uses ZipArchive::extractTo without limits on uncompressed size, entry count, ...

Deserialization of Untrusted Data

Overview typo3/cms-install is a TYPO3 extension install. The Install Tool is used for installation, upgrade, system administration and setup tasks. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the VariableFrontend or Registry. An attacker can execute...

Grav 代码注入漏洞

Grav is a scalable content management system CMS developed by the Grav open-source community, suitable for use in personal blogs, small content publishing platforms, and single-page product displays. Versions of Grav prior to 2.0.0-beta.2 contained a code injection vulnerability. This vulnerabili...

Linux Distros Unpatched Vulnerability : CVE-2026-35355

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The install utility in uutils coreutils is vulnerable to a Time-of-Check to Time-of-Use TOCTOU race condition during file installation. The implementation unlin...

Cleartext Storage of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information due to the SetupModuleController module merging entity data with user-interface settings before storing them in DB. An attacker can obtain sensitive user credentials by accessing the uc and...

EUVD-2017-2472

Malware in sbrugna...

Grav CMS 安全漏洞

Grav CMS is Grav open source a flat file-based content management system . Grav CMS suffers from a remote code execution vulnerability that originates from allowing authenticated administrators to upload malicious plugins via the admin/tools/direct-install interface, which can be exploited by an...

CVE-2025-50286

A Remote Code Execution RCE vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install interface. Once uploaded, the plugin is automatically extracted and loaded, allowing arbitrary PHP code execution and reverse shell access...

CVE-2024-55891

TYPO3 is a free and open source Content Management Framework. It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Users are advised to update to TYPO3 versions 13.4.3 ELTS which fixes the...