CVE-2025-9573

The nsbackup extension through 13.0.2 for TYPO3 allows command injection...

Command Injection

Overview nitsan/ns-backup is an extension for TYPO3 that lets you save your code, files, and database with just a few clicks. Install Backup Plus and connect it to your cloud storage like Google Drive, Dropbox, Amazon S3, SFTP, Rsync, etc.. Affected versions of this package are vulnerable to...

CVE-2025-9573

The nsbackup extension through 13.0.2 for TYPO3 allows command injection...

CVE-2025-9573 Command Injection in extension "TYPO3 Backup Plus" (ns_backup)

The nsbackup extension through 13.0.2 for TYPO3 allows command injection...

CVE-2025-9573

The CVE-2025-9573 entry concerns TYPO3 ns_backup (ns-backup) extension versions up to 13.0.2, where a command injection flaw exists in the generateBackup function. The root cause is improper handling of input that leads to arbitrary command execution when an administrator uses the extension’s bac...

CVE-2025-48206

The nsbackup extension through 13.0.0 for TYPO3 allows XSS...

Direct Request ('Forced Browsing')

Overview nitsan/ns-backup is an extension for TYPO3 that lets you save your code, files, and database with just a few clicks. Install Backup Plus and connect it to your cloud storage like Google Drive, Dropbox, Amazon S3, SFTP, Rsync, etc.. Affected versions of this package are vulnerable to Dire...

PT-2025-22375

Name of the Vulnerable Software and Affected Versions TYPO3 ns backup extension versions prior to 13.0.1 Description The issue allows for XSS. Recommendations For versions prior to 13.0.1, update to version 13.0.1 or later to resolve the issue...

PT-2025-22370

Name of the Vulnerable Software and Affected Versions ns backup extension for TYPO3 version 13.0.0 and earlier Description The issue concerns a Predictable Resource Location in the ns backup extension for TYPO3. This allows an unauthenticated remote user to download created backups and...

PT-2025-22373

Name of the Vulnerable Software and Affected Versions ns backup extension for TYPO3 versions through 13.0.0 Description The issue allows command injection when creating a backup. An authenticated backend user with access to the extension's backend module is required to exploit this issue...