Composer typo3/cms has 262 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2016-5385 | Environment Variable Injection | unknown | 0.0 | >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.1 | 8.2.1 |
| CVE-2009-0815 | TYPO3 leaks a hash secret in an error message | medium | 0.0 | >=3.3 and <4.0.12 or >=4.1 and <4.1.10 or >=4.2 and <4.2.6 | 4.0.12, 4.1.10, 4.2.6 |
| CVE-2010-3714 | TYPO3 Remote File Disclosure vulnerability in the jumpUrl mechanism | high | 0.0 | >=4.2.0 and <4.2.15 or >=4.3.0 and <4.3.7 or >=4.4.0 and <4.4.4 | 4.2.15, 4.3.7, 4.4.4 |
| CVE-2020-8091 | Typo3 Cross-Site Scripting in Flash component (ELTS) | medium | 6.1 | >=7.0.0 and <7.2.0 or >=6.2.0 and <6.2.39 | 7.2.0, 6.2.39 |
| CVE-2018-14041 | Bootstrap Cross-site Scripting vulnerability | medium | 6.1 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| CVE-2019-11832 | TYPO3 Image Processing susceptible to Code Execution | high | 7.5 | >=8.0.0 and <8.7.25 or >=9.0.0 and <9.5.6 | 8.7.25, 9.5.6 |
| CVE-2009-0258 | Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection | high | 0.0 | >=4.0.0 and <4.0.10 or >=4.1.0 and <4.1.8 or >=4.2.0 and <4.2.4 | 4.0.10, 4.1.8, 4.2.4 |
| CVE-2012-1607 | TYPO3 allows remote attackers to obtain the database name via a direct request | medium | 0.0 | >=4.4.0 and <=4.4.13 or >=4.5.0 and <=4.5.13 or >=4.6.0 and <=4.6.6 | – |
| CVE-2010-5099 | TYPO3 Path Traversal vulnerability | medium | 0.0 | >=4.2.0 and <4.2.16 or >=4.3.0 and <4.3.9 or >=4.4.0 and <4.4.5 | 4.2.16, 4.3.9, 4.4.5 |
| CVE-2013-4701 | PHP OpenID Library Denial of Service vulnerability | high | 0.0 | >=6.2.0 and <6.2.6 | 6.2.6 |
| CVE-2014-3941 | Typo3 Host Header Spoofing Vulnerability | medium | 0.0 | >=4.5.0 and <4.5.34 or >=4.7.0 and <4.7.19 or >=6.0.0 and <6.0.14 or >=6.1.0 and <6.1.9 or >=6.2.0 and <6.2.3 | 4.5.34, 4.7.19, 6.0.14, 6.1.9 |
| CVE-2013-7341 | Moodle cross-site scripting (XSS) vulnerabilities | medium | 0.0 | >=6.2.0 and <6.2.14 or >=7.0.0 and <7.3.1 or >=7.0.0 and <7.1.0 or >=7.1.0 and <7.2.0 or >=7.2.0 and <7.3.0 or >=7.3.0 and <7.3.1 | 6.2.14, 7.3.1 |
| CVE-2012-1605 | Typo3 Extbase Framework Unsafe Deserialization | medium | 0.0 | >=4.6 and <4.6.7 or >=4.4.0 and <4.4.14 or >=4.5.0 and <4.5.14 | 4.6.7, 4.4.14, 4.5.14 |
| CVE-2017-14251 | TYPO3 Arbitrary Code Execution | high | 8.8 | >=7.6.0 and <7.6.22 or >=8.0.0 and <8.7.5 | 7.6.22, 8.7.5 |
| CVE-2012-1608 | Typo3 API XSS Vulnerabilities | medium | 0.0 | >=4.4.0 and <4.4.14 or >=4.5.0 and <4.5.14 or >=4.6.0 and <4.6.7 | 4.4.14, 4.5.14, 4.6.7 |
| CVE-2019-10912 | Deserialization of untrusted data in Symfony | high | 7.1 | >=9.0.0 and <9.5.8 | 9.5.8 |
| CVE-2020-15098 | Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS | high | 8.8 | >=10.0.0 and <10.4.6 or >=9.0.0 and <9.5.20 | 10.4.6, 9.5.20 |
| CVE-2018-6905 | Typo3 XSS Vulnerability | medium | 4.8 | <9.2.0 | 9.2.0 |
| CVE-2012-6144 | Typo3 Backend History Module Vulnerable to SQL Injection | medium | 0.0 | >=4.5.0 and <4.5.21 or >=4.6.0 and <4.6.14 or >=4.7.0 and <4.7.6 | 4.5.21, 4.6.14, 4.7.6 |
| CVE-2012-3527 | TYPO3 allows remote authenticated backend users to unserialize arbitrary objects | medium | 0.0 | >=4.5.0 and <4.5.19 or >=4.6.0 and <4.6.12 or >=4.7.0 and <4.7.4 | 4.5.19, 4.6.12, 4.7.4 |
| CVE-2009-3635 | TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a Credential | medium | 0.0 | <=4.0.13 or >=4.1.0 and <4.1.13 or >=4.2.0 and <4.2.10 or >=4.3beta1 and <4.3beta2 | 4.1.13, 4.2.10, 4.3beta2 |
| CVE-2012-3528 | Typo3 Backend XSS Vulnerability | low | 0.0 | >=4.5 and <4.5.19 or >=4.6 and <4.6.12 or >=4.7 and <4.7.4 | 4.5.19, 4.6.12, 4.7.4 |
| CVE-2015-5956 | TYPO3 cross-site scripting (XSS) | low | 0.0 | >=6.0 and <6.2.15 or >=7.0 and <7.4.0 or >=4.0 and <=4.5.40 or >=6.2.0 and <6.2.15 or >=7.0.0 and <7.1.0 or >=7.1.0 and <7.2.0 or >=7.2.0 and <7.3.0 or >=7.3.0 and <7.4.0 | 6.2.15, 7.4.0 |
| CVE-2020-11067 | Insecure Deserialization in Backend User Settings in TYPO3 CMS | high | 8.8 | >=10.0.0 and <10.4.2 or >=9.0.0 and <9.5.17 | 10.4.2, 9.5.17 |
| CVE-2018-17960 | Ckeditor XSS Vulnerability | medium | 6.1 | >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 8.7.21, 9.5.2 |
| CVE-2010-5101 | TYPO3 Directory Traversal vulnerability | medium | 0.0 | >=4.2.0 and <4.2.16 or >=4.3.0 and <4.3.9 or >=4.4.0 and <4.4.5 | 4.2.16, 4.3.9, 4.4.5 |
| CVE-2012-6147 | Typo3 Backend API XSS Vulnerability | low | 0.0 | >=4.5.0 and <4.5.21 or >=4.6.0 and <4.6.14 or >=4.7.0 and <4.7.6 | 4.5.21, 4.6.14, 4.7.6 |
| CVE-2009-0256 | Authentication library in TYPO3 vulnerable to session fixation | high | 0.0 | >=4.0.0 and <4.0.10 or >=4.1.0 and <4.1.8 or >=4.2.0 and <4.2.4 | 4.0.10, 4.1.8, 4.2.4 |
| CVE-2020-15099 | Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS | high | 8.1 | >=10.0.0 and <10.4.6 or >=9.0.0 and <9.5.20 | 10.4.6, 9.5.20 |
| CVE-2021-21359 | Denial of Service in Page Error Handling | medium | 5.9 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 10.4.14, 11.1.1, 9.5.25 |
| CVE-2014-9508 | Typo3 Open Redirect In Frontend Rendering | medium | 0.0 | >=4.5.0 and <4.5.39 or >=4.6.0 and <6.2.9 or >=7.0.0 and <7.0.2 or >=6.2.0 and <6.2.9 | 4.5.39, 6.2.9, 7.0.2 |
| CVE-2012-3530 | Typo3 API XSS Vulnerability | medium | 0.0 | >=4.5 and <4.5.19 or >=4.6 and <4.6.12 or >=4.7 and <4.7.4 | 4.5.19, 4.6.12, 4.7.4 |
| CVE-2011-4628 | Typo3 Authentication Bypass | critical | 9.8 | <4.3.12 or >=4.4.0 and <4.4.9 or >=4.5.0 and <4.5.4 | 4.3.12, 4.4.9, 4.5.4 |
| CVE-2014-3945 | TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hash | critical | 0.0 | <6.2.0 | 6.2.0 |
| CVE-2014-3942 | TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code | high | 0.0 | >=4.5.0 and <4.5.34 or >=4.7.0 and <4.7.19 or >=6.0.0 and <6.0.14 or >=6.1.0 and <6.1.9 | 4.5.34, 4.7.19, 6.0.14, 6.1.9 |
| CVE-2021-21355 | Unrestricted File Upload in Form Framework | high | 8.6 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 10.4.14, 11.1.1, 9.5.25 |
| CVE-2022-36104 | TYPO3 CMS vulnerable to Denial of Service in Page Error Handling | medium | 5.9 | >=11.4.0 and <11.5.16 or >=11.0.0 and <11.5.16 | 11.5.16 |
| CVE-2012-1606 | Typo3 Backend XSS Vulnerabilities | low | 0.0 | >=4.4.0 and <4.4.14 or >=4.5.0 and <4.5.14 or >=4.6.0 and <4.6.7 | 4.4.14, 4.5.14, 4.6.7 |
| CVE-2021-21357 | Broken Access Control in Form Framework | high | 8.3 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 10.4.14, 11.1.1, 9.5.25 |
| CVE-2019-12747 | TYPO3 Vulnerable to Insecure Deserialization | high | 8.8 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| CVE-2020-11066 | Class destructors causing side-effects when being unserialized in TYPO3 CMS | high | 8.7 | >=10.0.0 and <10.4.2 or >=9.0.0 and <9.5.17 | 10.4.2, 9.5.17 |
| CVE-2014-9509 | Typo3 Vulnerable to Cache Poisoning | high | 0.0 | >=4.5.0 and <4.5.39 or >=6.2.0 and <6.2.9 or >=7.0.0 and <7.0.2 or >=4.6.0 and <4.6.19 or >=4.7.0 and <4.7.21 or >=6.0.0 and <6.0.15 or >=6.1.0 and <6.1.13 | 4.5.39, 6.2.9, 7.0.2, 4.6.19 |
| CVE-2012-3531 | Typo3 Install Tool XSS Vulnerability | medium | 0.0 | >=4.5 and <4.5.19 or >=4.6 and <4.6.12 or >=4.7 and <4.7.4 | 4.5.19, 4.6.12, 4.7.4 |
| CVE-2019-19848 | TYPO3 Directory Traversal on ZIP extraction | medium | 6.8 | >=10.0.0 and <10.2.2 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 or >=10.0.0 and <10.2.1 | 10.2.2, 8.7.30, 9.5.12 |
| CVE-2014-3943 | Typo3 XSS Vulnerabilities | low | 0.0 | >=4.5.0 and <4.5.34 or >=4.7.0 and <4.7.19 or >=6.0.0 and <6.0.14 or >=6.1.0 and <6.1.9 or >=6.2.0 and <6.2.3 | 4.5.34, 4.7.19, 6.0.14, 6.1.9 |
| CVE-2015-8760 | TYPO3 allows remote attackers to embed Flash videos from external domain | medium | 6.1 | >=6.2.0 and <6.2.16 | 6.2.16 |
| CVE-2012-2112 | Typo3 Exception Handler XSS | medium | 0.0 | >=4.4 and <4.4.15 or >=4.5 and <4.5.15 or >=4.6 and <4.6.8 or =4.7 | 4.4.15, 4.5.15, 4.6.8 |
| CVE-2005-4875 | TYPO3 Reveals Sensitive Information via Direct Request to `misc/phpcheck/` | high | 0.0 | <3.8.1 | 3.8.1 |
| CVE-2011-3583 | Typo3 SQL injection due to faulty prepared statements | critical | 9.8 | >=4.5.0 and <=4.5.5 | – |
| CVE-2014-3944 | TYPO3 Improper Session Invalidation | medium | 0.0 | >=6.2.0 and <6.2.3 | 6.2.3 |
| CVE-2010-5103 | TYPO3 SQL Injection vulnerability | medium | 0.0 | >=4.2.0 and <4.2.16 or >=4.3.0 and <4.3.9 or >=4.4.0 and <4.4.5 | 4.2.16, 4.3.9, 4.4.5 |
| CVE-2013-7075 | TYPO3 vulnerable to Insecure Unserialize via Content Editing Wizards component | medium | 6.3 | >=4.5.0 and <4.5.32 or >=4.7.0 and <4.7.17 or >=6.0.0 and <6.0.12 or >=6.1.0 and <6.1.7 | 4.5.32, 4.7.17, 6.0.12, 6.1.7 |
| CVE-2019-19849 | TYPO3 Insecure Deserialization in Query Generator & Query View | high | 8.8 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| CVE-2013-7073 | TYPO3 vulnerable to Information Disclosure via Content Editing Wizards component | medium | 6.5 | >=4.5.0 and <4.5.32 or >=4.7.0 and <4.7.17 or >=6.0.0 and <6.0.12 or >=6.1.0 and <6.1.7 | 4.5.32, 4.7.17, 6.0.12, 6.1.7 |
| CVE-2022-36105 | TYPO3 CMS vulnerable to User Enumeration via Response Timing | medium | 5.3 | >=10.0.0 and <10.4.32 or >=11.0.0 and <11.5.16 | 10.4.32, 11.5.16 |
| CVE-2022-31050 | Insufficient Session Expiration in TYPO3's Admin Tool | medium | 6.0 | >=10.0.0 and <10.4.29 or >=11.0.0 and <11.5.11 | 10.4.29, 11.5.11 |
| CVE-2021-41114 | HTTP Host Header Injection | medium | 4.8 | >=11.0.0 and <11.5.0 | 11.5.0 |
| CVE-2020-11063 | Information Disclosure in Password Reset | low | 3.7 | >=10.0.0 and <10.4.2 | 10.4.2 |
| CVE-2012-6145 | Typo3 Backend History Module Vulnerable to XSS | low | 0.0 | >=4.5.0 and <4.5.21 or >=4.6.0 and <4.6.14 or >=4.7.0 and <4.7.6 | 4.5.21, 4.6.14, 4.7.6 |
| CVE-2012-6148 | Typo3 Function Menu API XSS Vulnerability | low | 0.0 | >=4.5.0 and <4.5.21 or >=4.6.0 and <4.6.14 or >=4.7.0 and <4.7.6 | 4.5.21, 4.6.14, 4.7.6 |
| CVE-2010-1153 | TYPO3 PHP remote file inclusion vulnerability | high | 0.0 | >=4.3.0 and <4.3.3 | 4.3.3 |
| CVE-2013-4250 | TYPO3 doesn't properly check file extensions | high | 0.0 | >=6.0.0 and <6.0.8 or >=6.1.0 and <6.1.3 | 6.0.8, 6.1.3 |
| CVE-2015-8755 | Typo3 XSS Vulnerability | medium | 5.4 | >=6.2 and <6.2.16 or >=7.0 and <7.6.1 | 6.2.16, 7.6.1 |
| CVE-2011-4901 | Typo3 Arbitrary Information Disclosure | medium | 6.5 | <4.3.12 or >=4.4.0 and <4.4.9 or >=4.5.0 and <4.5.4 | 4.3.12, 4.4.9, 4.5.4 |
| CVE-2011-4904 | Typo3 Improper Access Control | medium | 6.5 | <4.4.9 or >=4.5.0 and <4.5.4 | 4.4.9, 4.5.4 |
| CVE-2022-31047 | Insertion of Sensitive Information into Log File in typo3/cms-core | medium | 5.3 | >=10.0.0 and <10.4.29 or >=11.0.0 and <11.5.11 | 10.4.29, 11.5.11 |
| CVE-2013-4321 | TYPO3 vulnerable to remote authenticated arbitrary code execution | high | 0.0 | >=6.0.0 and <6.0.9 or >=6.1.0 and <6.1.4 | 6.0.9, 6.1.4 |
| CVE-2014-3946 | Typo3 Information Disclosure | medium | 0.0 | >=6.2.0 and <6.2.3 | 6.2.3 |
| CVE-2021-21338 | Open Redirection in Login Handling | medium | 6.1 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 10.4.14, 11.1.1, 9.5.25 |
| CVE-2013-7074 | TYPO3 Cross-Site Scripting (XSS) vulnerabilities in Content Editing Wizards component | low | 3.0 | >=4.5.0 and <4.5.32 or >=4.7.0 and <4.7.17 or >=6.0.0 and <6.0.12 or >=6.1.0 and <6.1.7 | 4.5.32, 4.7.17, 6.0.12, 6.1.7 |
| CVE-2016-4056 | TYPO3 Backend component Cross-site scripting (XSS) vulnerability | medium | 6.1 | >=6.2.0 and <6.2.19 | 6.2.19 |
| CVE-2009-0816 | Typo3 Backend XSS Vulnerability | medium | 0.0 | >=3.3.0 or >=4.0 and <4.0.12 or >=4.1.0 and <4.1.10 or >=4.2.0 and <4.2.6 or =4.3alpha1 | – |
| CVE-2012-6146 | Typo3 Backend History Module Vulnerable to XSS | medium | 0.0 | >=4.5 and <4.5.21 or >=4.6 and <4.6.14 or >=4.7 and <4.7.6 | 4.5.21, 4.6.14, 4.7.6 |
| CVE-2017-6370 | TYPO3 Information Disclosure Vulnerability | medium | 5.3 | =7.6.15 | – |
| CVE-2011-4902 | Typo3 Arbitrary File Delete | medium | 6.5 | <4.3.12 or >=4.4.0 and <4.4.9 or >=4.5.0 and <4.5.4 | 4.3.12, 4.4.9, 4.5.4 |
| CVE-2020-15241 | Cross-Site Scripting in ternary conditional operator | medium | 4.7 | >=8.0.0 and <8.7.25 or >=9.0.0 and <9.5.6 | 8.7.25, 9.5.6 |
| CVE-2011-4627 | Typo3 Information Disclosure | medium | 6.5 | <4.3.12 or >=4.4.0 and <4.4.9 or >=4.5.0 and <4.5.4 | 4.3.12, 4.4.9, 4.5.4 |
| CVE-2011-4900 | Typo3 Information Disclosure | medium | 6.5 | <4.5.4 | 4.5.4 |
| CVE-2022-36106 | TYPO3 CMS missing check for expiration time of password reset token for backend users | medium | 5.4 | >=10.4.0 and <10.4.32 or >=11.0.0 and <11.5.16 or >=10.0.0 and <10.4.32 | 10.4.32, 11.5.16 |
| CVE-2022-36107 | TYPO3 CMS Stored Cross-Site Scripting via FileDumpController | medium | 5.4 | >=10.0.0 and <10.4.32 or >=11.0.0 and <11.5.16 | 10.4.32, 11.5.16 |
| CVE-2022-36108 | TYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helper | medium | 5.4 | >=10.3.0 and <10.4.32 or >=11.0.0 and <11.5.16 or >=10.0.0 and <10.4.32 | 10.4.32, 11.5.16 |
| CVE-2021-21339 | Cleartext storage of session identifier | medium | 5.9 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 10.4.14, 11.1.1, 9.5.25 |
| CVE-2021-21340 | Cross-Site Scripting in Content Preview | medium | 5.4 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 | 10.4.14, 11.1.1 |
| CVE-2021-21358 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form | medium | 5.4 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 | 10.4.14, 11.1.1 |
| CVE-2021-21370 | Cross-Site Scripting in Content Preview (CType menu) | medium | 5.4 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 or >=9.0.0 and <9.5.25 | 10.4.14, 11.1.1, 9.5.25 |
| CVE-2019-19850 | TYPO3 SQL Injection in low-level Query Generator | medium | 5.5 | >=8.0 and <8.7.30 or >=9.0 and <9.5.12 or >=10.0 and <10.2.2 or >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 8.7.30, 9.5.12, 10.2.2 |
| CVE-2012-3529 | Typo3 Backend Configuration XSS Vulnerability | low | 0.0 | >=4.5 and <4.5.19 or >=4.6 and <4.6.12 or >=4.7 and <4.7.4 | 4.5.19, 4.6.12, 4.7.4 |
| CVE-2022-23503 | TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework | high | 7.5 | >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 or >=12.0.0 and <12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| CVE-2011-4903 | Typo3 XSS in RemoveXSS function | medium | 6.1 | <4.3.12 or >=4.4.0 and <4.4.9 or >=4.5.0 and <4.5.4 | 4.3.12, 4.4.9, 4.5.4 |
| CVE-2023-24814 | TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering | high | 8.8 | >=10.0.0 and <10.4.35 or >=11.0.0 and <11.5.23 or >=12.0.0 and <12.2.0 | 10.4.35, 11.5.23, 12.2.0 |
| CVE-2021-32767 | Information Disclosure in User Authentication | medium | 5.3 | >=10.0.0 and <10.4.18 or >=11.0.0 and <11.3.1 or >=9.0.0 and <9.5.28 | 10.4.18, 11.3.1, 9.5.28 |
| CVE-2022-36020 | TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection | medium | 6.1 | >=10.0.0 and <10.4.32 or >=11.0.0 and <11.5.16 | 10.4.32, 11.5.16 |
| CVE-2015-8756 | TYPO3 CMS indexed search Cross-site Scripting vulnerability | medium | 5.4 | >=6.2.0 and <6.2.16 | 6.2.16 |
| CVE-2022-31048 | Cross-Site Scripting in TYPO3's Form Framework | medium | 5.4 | >=10.0.0 and <10.4.29 or >=11.0.0 and <11.5.11 | 10.4.29, 11.5.11 |
| CVE-2022-31049 | Cross-Site Scripting in TYPO3's Frontend Login Mailer | medium | 5.4 | >=10.0.0 and <10.4.29 or >=11.0.0 and <11.5.11 | 10.4.29, 11.5.11 |
| CVE-2020-11069 | Backend Same-Site Request Forgery in TYPO3 CMS | high | 8.0 | >=10.0.0 and <10.4.2 or >=9.0.0 and <9.5.17 | 10.4.2, 9.5.17 |
| CVE-2022-23500 | TYPO3 CMS vulnerable to Denial of Service in Page Error Handling | medium | 5.9 | >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 | 10.4.33, 11.5.20 |
| CVE-2021-32768 | Cross-Site Scripting via Rich-Text Content | medium | 6.1 | >=10.0.0 and <10.4.19 or >=11.0.0 and <11.3.2 or >=9.0.0 and <9.5.29 or >=8.0.0 and <8.7.42 or >=7.0.0 and <7.6.53 | 10.4.19, 11.3.2, 9.5.29, 8.7.42 |
| CVE-2020-26227 | Cross-Site Scripting in Fluid view helpers | medium | 6.1 | >=10.0.0 and <10.4.10 or >=9.0.0 and <9.5.23 or >=8.7.0 and <8.7.38 | 10.4.10, 9.5.23, 8.7.38 |
| CVE-2019-12748 | Typo3 Cross-Site Scripting in Link Handling | medium | 6.1 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| CVE-2011-4630 | Typo3 XSS Vulnerability | medium | 5.4 | >=4.5.0 and <4.5.4 or >=4.4.0 and <4.4.9 or <4.3.12 | 4.5.4, 4.4.9, 4.3.12 |
| CVE-2011-4632 | Typo3 XSS Vulnerabilities | medium | 5.4 | <4.3.12 or >=4.4.0 and <4.4.9 or >=4.5.0 and <4.5.4 | 4.3.12, 4.4.9, 4.5.4 |
| CVE-2020-26228 | Cleartext storage of session identifier | high | 8.1 | >=10.0.0 and <10.4.10 or >=9.0.0 and <9.5.23 or >=8.7.0 and <8.7.38 | 10.4.10, 9.5.23, 8.7.38 |
| CVE-2020-26229 | XML External Entity in Dashboard Widget | low | 3.7 | >=10.0.0 and <10.4.10 | 10.4.10 |
| CVE-2015-8759 | TYPO3 Cross-site Scripting vulnerability | medium | 5.4 | >=6.2.0 and <6.2.16 or >=7.0.0 and <7.6.1 | 6.2.16, 7.6.1 |
| CVE-2021-41113 | Cross-Site-Request-Forgery in Backend | high | 8.8 | >=11.2.0 and <11.5.0 | 11.5.0 |
| CVE-2022-31046 | Information Disclosure via Export Module | medium | 4.3 | >=10.0.0 and <10.4.29 or >=11.0.0 and <11.5.11 | 10.4.29, 11.5.11 |
| CVE-2021-32667 | Cross-Site Scripting in Page Preview | medium | 6.4 | >=10.0.0 and <10.4.18 or >=11.0.0 and <11.3.1 or >=9.0.0 and <9.5.28 | 10.4.18, 11.3.1, 9.5.28 |
| CVE-2021-32669 | Cross-Site Scripting in Backend Grid View | medium | 6.4 | >=10.0.0 and <10.4.18 or >=11.0.0 and <11.3.1 or >=9.0.0 and <9.5.28 | 10.4.18, 11.3.1, 9.5.28 |
| CVE-2021-32668 | Cross-Site Scripting in Query Generator & Query View | medium | 6.4 | >=10.0.0 and <10.4.18 or >=11.0.0 and <11.3.1 or >=9.0.0 and <9.5.28 | 10.4.18, 11.3.1, 9.5.28 |
| CVE-2022-23504 | TYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configuration | medium | 5.7 | >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 or >=12.0.0 and <12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| CVE-2020-11064 | Cross-Site Scripting in TYPO3 CMS Form Engine | medium | 5.4 | >=10.0.0 and <10.4.2 or >=9.0.0 and <9.5.17 | 10.4.2, 9.5.17 |
| CVE-2020-11065 | Cross-Site Scripting in TYPO3 CMS Link Handling | medium | 5.4 | >=10.0.0 and <10.4.2 or >=9.0.0 and <9.5.17 | 10.4.2, 9.5.17 |
| CVE-2022-23501 | TYPO3 CMS vulnerable to Weak Authentication in Frontend Login | medium | 5.9 | >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 or >=12.0.0 and <12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| CVE-2022-47406 | TYPO3 vulnerable to Insufficient Session Expiration | critical | 9.8 | <2.0.5 or >=3.0.0 and <3.0.3 | 2.0.5, 3.0.3 |
| CVE-2022-23499 | TYPO3 HTML Sanitizer vulnerable to Cross-Site Scripting | medium | 6.1 | >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 or >=12.0.0 and <12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| CVE-2022-23502 | TYPO3 CMS vulnerable to Insufficient Session Expiration after Password Reset | medium | 5.4 | >=10.0.0 and <10.4.33 or >=11.0.0 and <11.5.20 or >=12.0.0 and <12.1.1 | 10.4.33, 11.5.20, 12.1.1 |
| GHSA-67wg-6j7r-mqh8 | Arbitrary Code Execution in TYPO3 CMS | critical | 9.9 | >=7.6.0 and <7.6.22 or >=8.0.0 and <8.7.5 | 7.6.22, 8.7.5 |
| GHSA-gwfx-p7mr-f92v | Missing Access Check in TYPO3 CMS | critical | 9.0 | >=6.2.0 and <6.2.25 or >=7.6.0 and <7.6.8 or >=8.0.0 and <8.1.1 | 6.2.25, 7.6.8, 8.1.1 |
| GHSA-4r76-xr68-w7m7 | TYPO3 may allow editors to change, create, or delete metadata of files not within their file mounts | high | 8.8 | >=6.2.0 and <6.2.14 or >=7.0.0 and <7.3.1 | 6.2.14, 7.3.1 |
| GHSA-7qwg-fcpw-xg5g | Privilege Escalation & SQL Injection in TYPO3 CMS | high | 8.8 | >=8.5.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 8.7.17, 9.3.2 |
| GHSA-8h4m-r4wm-xj7r | TYPO3 Arbitrary Code Execution via File List Module | high | 8.8 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| GHSA-45xg-4w5x-j429 | TYPO3 Arbitrary Shell Execution in Swiftmailer library | high | 8.1 | >=6.2.0 and <6.2.6 or >=6.1.0 and <6.1.12 or >=4.7.0 and <4.7.20 or >=4.5.0 and <4.5.37 | 6.2.6, 6.1.12, 4.7.20, 4.5.37 |
| GHSA-f777-f784-36gm | TYPO3 Security Misconfiguration in Install Tool Cookie | high | 8.1 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| GHSA-hh95-5xm5-v8v7 | TYPO3 CMS Possible Insecure Deserialization in Extbase Request Handling | high | 8.1 | >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 8.7.30, 9.5.12 |
| GHSA-g585-crjf-vhwq | TYPO3 Denial of Service in Frontend Record Registration | high | 7.5 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 | 7.6.32, 8.7.21 |
| GHSA-c5mj-39cf-3pp5 | TYPO3 Security Misconfiguration for Backend User Accounts | high | 7.3 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| GHSA-r9vc-jfmh-6j48 | TYPO3 frontend login vulnerable to Session Fixation | high | 7.1 | >=6.2.0 and <6.2.14 or >=7.0.0 and <7.3.1 | 6.2.14, 7.3.1 |
| GHSA-5gr6-97fv-52cc | Cross-Site Scripting in TYPO3 CMS | medium | 6.5 | >=7.6.0 and <7.6.16 or >=8.0.0 and <8.6.1 | 7.6.16, 8.6.1 |
| GHSA-772m-43f3-hmf8 | TYPO3 Broken Access Control in Localization Handling | medium | 6.5 | >=8.0.0 and <8.7.23 | 8.7.23 |
| GHSA-f3wf-q4fj-3gxf | TYPO3 Denial of Service in Online Media Asset Handling | medium | 6.5 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| GHSA-jqr8-q455-xx45 | TYPO3 Brute Force Protection Bypass in backend login | medium | 6.5 | >=6.2.0 and <6.2.14 or >=7.0.0 and <7.3.1 | 6.2.14, 7.3.1 |
| GHSA-r287-hc8j-w56h | TYPO3 Information Disclosure Vulnerability Exploitable by Editors | medium | 6.5 | >=6.2.0 and <6.2.14 or >=7.0.0 and <7.3.1 | 6.2.14, 7.3.1 |
| GHSA-v5jp-4h2p-j2p4 | Privilege Escalation in TYPO3 CMS | medium | 6.5 | >=6.2.0 and <6.2.20 or >=7.6.0 and <7.6.5 or >=8.0.0 and <8.0.1 | 6.2.20, 7.6.5, 8.0.1 |
| GHSA-xvcp-33rc-j8gq | Insecure Unserialize in TYPO3 Import/Export | medium | 6.3 | >=6.2.0 and <6.2.26 or >=7.6.0 and <7.6.10 or >=8.0.0 and <8.2.1 | 6.2.26, 7.6.10, 8.2.1 |
| GHSA-4h5c-5g25-v7fh | TYPO3 Cross-Site Scripting in Form Framework | medium | 6.1 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| GHSA-85ch-44w7-rf32 | TYPO3 Cross-Site Scripting in Fluid ViewHelpers | medium | 6.1 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| GHSA-g7hw-jh4p-75wr | TYPO3 Cross-Site Scripting in Filelist Module | medium | 6.1 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| GHSA-mxjf-hc9v-xgv2 | ExtJS JavaScript framework used in TYPO3 vulnerable to Cross-site Scripting | medium | 6.1 | >=6.2.0 and <6.2.3 or >=6.1.0 and <6.1.9 or >=4.7.0 and <4.7.19 or >=4.5.0 and <4.5.34 | 6.2.3, 6.1.9, 4.7.19, 4.5.34 |
| GHSA-v8m4-3w37-ghxx | TYPO3 Cross-Site Scripting in Form Framework validation handling | medium | 6.1 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| GHSA-xgmx-j3hv-jh9x | TYPO3 Cross-Site Scripting in Link Handling | medium | 6.1 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| GHSA-2rcw-9hrm-8q7q | TYPO3 Cross-Site Scripting in Frontend User Login | medium | 5.4 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| GHSA-6xh8-8pfv-53vx | Authentication Bypass in TYPO3 CMS | medium | 5.4 | >=6.2.0 and <6.2.20 or >=7.6.0 and <7.6.5 or >=8.0.0 and <8.0.1 | 6.2.20, 7.6.5, 8.0.1 |
| GHSA-7q33-hxwj-7p8v | TYPO3 Cross-Site Scripting in Backend Modal Component | medium | 5.4 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| GHSA-8m6j-p5jv-v69w | TYPO3 Cross-Site Scripting in Online Media Asset Rendering | medium | 5.4 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| GHSA-j86x-pjmr-9m6w | SQL Injection in TYPO3 Frontend Login | medium | 5.4 | >=6.2.0 and <6.2.26 or >=7.6.0 and <7.6.10 | 6.2.26, 7.6.10 |
| GHSA-mh3r-6cp5-hc2j | Authentication Bypass in TYPO3 Frontend | medium | 5.4 | >=8.2.0 and <8.6.1 | 8.6.1 |
| GHSA-v4qr-8h2v-qpjx | Cross-Site Scripting in TYPO3 CMS Backend | medium | 5.4 | >=8.0.0 and <8.7.5 | 8.7.5 |
| GHSA-wp8j-c736-c5r3 | TYPO3 Cross-Site Scripting Vulnerability Exploitable by Editors | medium | 5.4 | >=6.2.0 and <6.2.14 or >=7.0.0 and <7.3.1 | 6.2.14, 7.3.1 |
| GHSA-6487-3qvg-8px9 | TYPO3 Information Disclosure in Install Tool | medium | 5.3 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| GHSA-f624-8hfq-5fh3 | TYPO3 Information Disclosure of Installed Extensions | medium | 5.3 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| GHSA-pqfv-97hj-g97g | TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure | medium | 5.3 | >=6.2.0 and <6.2.15 or >=7.0.0 and <7.4.0 | 6.2.15, 7.4.0 |
| GHSA-pw2q-qwvj-gh43 | Cache Flooding in TYPO3 Frontend | medium | 5.3 | >=6.2.0 and <6.2.27 or >=7.6.0 and <7.6.11 or >=8.0.0 and <8.3.1 | 6.2.27, 7.6.11, 8.3.1 |
| GHSA-vpr3-rc99-2wpr | Information Disclosure in TYPO3 Backend | medium | 5.3 | >=6.2.0 and <6.2.26 or >=7.6.0 and <7.6.10 or >=8.0.0 and <8.2.1 | 6.2.26, 7.6.10, 8.2.1 |
| GHSA-c7rj-92xr-wprg | Insecure Unserialize in TYPO3 Backend | medium | 5.0 | >=6.2.0 and <6.2.29 or >=7.6.0 and <7.6.13 or >=8.0.0 and <8.4.1 | 6.2.29, 7.6.13, 8.4.1 |
| GHSA-5wx6-xwxf-q8qj | Cross-Site Scripting in TYPO3 Backend | medium | 4.6 | >=6.2.0 and <6.2.20 or >=7.6.0 and <7.6.5 or >=8.0.0 and <8.0.1 | 6.2.20, 7.6.5, 8.0.1 |
| GHSA-86r8-4g3w-7xjp | Cross-Site Scripting in TYPO3 Backend | medium | 4.6 | >=6.2.0 and <6.2.26 or >=7.6.0 and <7.6.10 or >=8.0.0 and <8.2.1 | 6.2.26, 7.6.10, 8.2.1 |
| GHSA-g46h-v2cc-6c94 | Information Disclosure in TYPO3 CMS | medium | 4.3 | >=7.6.0 and <7.6.22 or >=8.0.0 and <8.7.5 | 7.6.22, 8.7.5 |
| GHSA-c7p6-3c9c-f88q | Information Disclosure in TYPO3 CMS | low | 3.7 | >=7.6.0 and <7.6.22 or >=8.0.0 and <8.7.5 | 7.6.22, 8.7.5 |
| 2014-05-22-1 | The ExtJS JavaScript framework that is shipped with TYPO3 is susceptible to XSS | unknown | 0.0 | >=6.2.0 and <6.2.3 | 6.2.3 |
| 2014-10-22-2 | Arbitrary Shell Execution in Swiftmailer library | unknown | 0.0 | >=6.2.0 and <6.2.6 | 6.2.6 |
| 2014-12-09-2 | Possible cache poisining on the homepage when anchors are used | unknown | 0.0 | >=6.2.0 and <6.2.9 or >=7.0.0 and <7.0.2 | 6.2.9, 7.0.2 |
| 2015-07-01-1 | Access bypass when editing file metadata | unknown | 0.0 | >=6.2.0 and <6.2.14 or >=7.0.0 and <7.1.0 or >=7.1.0 and <7.2.0 or >=7.2.0 and <7.3.0 or >=7.3.0 and <7.3.1 | 6.2.14, 7.3.1 |
| 2015-07-01-2 | Frontend login Session Fixation | unknown | 0.0 | >=6.2.0 and <6.2.14 or >=7.0.0 and <7.1.0 or >=7.1.0 and <7.2.0 or >=7.2.0 and <7.3.0 or >=7.3.0 and <7.3.1 | 6.2.14, 7.3.1 |
| 2015-07-01-3 | Cross-Site Scripting exploitable by Editors | unknown | 0.0 | >=6.2.0 and <6.2.14 or >=7.0.0 and <7.1.0 or >=7.1.0 and <7.2.0 or >=7.2.0 and <7.3.0 or >=7.3.0 and <7.3.1 | 6.2.14, 7.3.1 |
| 2015-07-01-4 | Information Disclosure possibility exploitable by Editors | unknown | 0.0 | >=6.2.0 and <6.2.14 or >=7.0.0 and <7.1.0 or >=7.1.0 and <7.2.0 or >=7.2.0 and <7.3.0 or >=7.3.0 and <7.3.1 | 6.2.14, 7.3.1 |
| 2015-07-01-5 | Brute Force Protection Bypass in backend login | unknown | 0.0 | >=6.2.0 and <6.2.14 or >=7.0.0 and <7.1.0 or >=7.1.0 and <7.2.0 or >=7.2.0 and <7.3.0 or >=7.3.0 and <7.3.1 | 6.2.14, 7.3.1 |
| 2015-09-08-1 | Frontend: Unauthenticated Path Disclosure | unknown | 0.0 | >=6.2.0 and <6.2.15 or >=7.0.0 and <7.1.0 or >=7.1.0 and <7.2.0 or >=7.2.0 and <7.3.0 or >=7.3.0 and <7.4.0 | 6.2.15, 7.4.0 |
| 2015-12-15-1 | Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend | unknown | 0.0 | >=6.2.0 and <6.2.16 or >=7.0.0 and <7.1.0 or >=7.1.0 and <7.2.0 or >=7.2.0 and <7.3.0 or >=7.3.0 and <7.4.0 or >=7.4.0 and <7.5.0 or >=7.5.0 and <7.6.0 or >=7.6.0 and <7.6.1 | 6.2.16, 7.6.1 |
| 2015-12-15-2 | Cross-Site Scripting vulnerability in typolinks | unknown | 0.0 | >=6.2.0 and <6.2.16 or >=7.0.0 and <7.1.0 or >=7.1.0 and <7.2.0 or >=7.2.0 and <7.3.0 or >=7.3.0 and <7.4.0 or >=7.4.0 and <7.5.0 or >=7.5.0 and <7.6.0 or >=7.6.0 and <7.6.1 | 6.2.16, 7.6.1 |
| 2015-12-15-3 | Multiple Cross-Site Scripting vulnerabilities in frontend | unknown | 0.0 | >=6.2.0 and <6.2.16 or >=7.0.0 and <7.1.0 or >=7.1.0 and <7.2.0 or >=7.2.0 and <7.3.0 or >=7.3.0 and <7.4.0 or >=7.4.0 and <7.5.0 or >=7.5.0 and <7.6.0 or >=7.6.0 and <7.6.1 | 6.2.16, 7.6.1 |
| 2015-12-15-4 | TYPO3 is susceptible to Cross-Site Flashing | unknown | 0.0 | >=6.2.0 and <6.2.16 | 6.2.16 |
| 2015-12-15-5 | Cross-Site Scripting in TYPO3 component Indexed Search | unknown | 0.0 | >=6.2.0 and <6.2.16 | 6.2.16 |
| 2016-02-16-1 | SQL Injection in dbal | unknown | 0.0 | >=6.2.0 and <6.2.18 | 6.2.18 |
| 2016-02-16-2 | Cross-Site Scripting in link validator component | unknown | 0.0 | >=6.2.0 and <6.2.18 or >=7.6.0 and <7.6.3 | 6.2.18, 7.6.3 |
| 2016-02-16-3 | Cross-Site Scripting in legacy form component | unknown | 0.0 | >=6.2.0 and <6.2.18 | 6.2.18 |
| 2016-02-16-4 | Cross-Site Scripting in form component | unknown | 0.0 | >=6.2.0 and <6.2.18 | 6.2.18 |
| 2016-02-23-1 | XML External Entity (XXE) Processing in TYPO3 Core | unknown | 0.0 | >=6.2.0 and <6.2.19 or >=7.6.0 and <7.6.4 | 6.2.19, 7.6.4 |
| 2016-02-23-2 | Cross-Site Scripting in TYPO3 component Backend | unknown | 0.0 | >=6.2.0 and <6.2.19 | 6.2.19 |
| 2016-02-23-3 | Cross-Site Scripting in TYPO3 component CSS styled content | unknown | 0.0 | >=6.2.0 and <6.2.19 or >=7.6.0 and <7.6.4 | 6.2.19, 7.6.4 |
| 2016-02-23-4 | Denial of Service attack possibility in TYPO3 component Indexed Search | unknown | 0.0 | >=6.2.0 and <6.2.19 or >=7.6.0 and <7.6.4 | 6.2.19, 7.6.4 |
| 2016-04-12-1 | Cross-Site Scripting in TYPO3 Backend | unknown | 0.0 | >=6.2.0 and <6.2.20 or >=7.6.0 and <7.6.5 or >=8.0.0 and <8.0.1 | 6.2.20, 7.6.5, 8.0.1 |
| 2016-04-12-2 | Arbitrary File Disclosure in Form Component | unknown | 0.0 | >=6.2.0 and <6.2.20 | 6.2.20 |
| 2016-04-12-3 | Authentication Bypass in TYPO3 CMS | unknown | 0.0 | >=6.2.0 and <6.2.20 or >=7.6.0 and <7.6.5 or >=8.0.0 and <8.0.1 | 6.2.20, 7.6.5, 8.0.1 |
| 2016-04-12-4 | Privilege Escalation in TYPO3 CMS | unknown | 0.0 | >=6.2.0 and <6.2.20 or >=7.6.0 and <7.6.5 or >=8.0.0 and <8.0.1 | 6.2.20, 7.6.5, 8.0.1 |
| 2016-05-24-1 | Missing Access Check in TYPO3 CMS | unknown | 0.0 | >=6.2.0 and <6.2.25 or >=7.6.0 and <7.6.8 or >=8.0.0 and <8.1.1 or >=8.1.0 and <8.1.1 | 6.2.25, 7.6.8, 8.1.1 |
| 2016-07-19-1 | Cross-Site Scripting in TYPO3 Backend | unknown | 0.0 | >=6.2.0 and <6.2.26 or >=7.6.0 and <7.6.10 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.1 | 6.2.26, 7.6.10, 8.2.1 |
| 2016-07-19-2 | Insecure Unserialize in TYPO3 Import/Export | unknown | 0.0 | >=6.2.0 and <6.2.26 or >=7.6.0 and <7.6.10 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.1 | 6.2.26, 7.6.10, 8.2.1 |
| 2016-07-19-3 | SQL Injection in TYPO3 Frontend Login | unknown | 0.0 | >=6.2.0 and <6.2.26 or >=7.6.0 and <7.6.10 | 6.2.26, 7.6.10 |
| 2016-07-19-4 | Information Disclosure in TYPO3 Backend | unknown | 0.0 | >=6.2.0 and <6.2.26 or >=7.6.0 and <7.6.10 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.1 | 6.2.26, 7.6.10, 8.2.1 |
| 2016-07-19-5 | Cross-Site Scripting vulnerability in typolinks | unknown | 0.0 | >=6.2.0 and <6.2.26 or >=7.6.0 and <7.6.10 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.1 | 6.2.26, 7.6.10, 8.2.1 |
| 2016-07-19-7 | Cross-Site Scripting in third party library mso/idna-convert | unknown | 0.0 | >=7.6.0 and <7.6.10 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.2.1 | 7.6.10, 8.2.1 |
| 2016-09-14-1 | Cross-Site Scripting in TYPO3 Backend | unknown | 0.0 | >=6.2.0 and <6.2.27 or >=7.6.0 and <7.6.11 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.3.1 | 6.2.27, 7.6.11, 8.3.1 |
| 2016-09-14-2 | Cache Flooding in TYPO3 Frontend | unknown | 0.0 | >=6.2.0 and <6.2.27 or >=7.6.0 and <7.6.11 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.3.1 | 6.2.27, 7.6.11, 8.3.1 |
| 2016-11-22-1 | Insecure Unserialize in TYPO3 Backend | unknown | 0.0 | >=6.2.0 and <6.2.29 or >=7.6.0 and <7.6.13 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.4.1 | 6.2.29, 7.6.13, 8.4.1 |
| 2016-11-22-2 | Path Traversal in TYPO3 Core | unknown | 0.0 | >=6.2.0 and <6.2.29 or >=7.6.0 and <7.6.13 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.4.1 | 6.2.29, 7.6.13, 8.4.1 |
| 2017-01-03-1 | Remote Code Execution in third party library swiftmailer | unknown | 0.0 | >=6.2.0 and <6.2.30 or >=7.6.0 and <7.6.15 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.5.1 | 6.2.30, 7.6.15, 8.5.1 |
| 2017-02-28-1 | Authentication Bypass in TYPO3 Frontend | unknown | 0.0 | >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.6.1 | 8.6.1 |
| 2017-02-28-2 | Cross-Site Scripting in TYPO3 CMS | unknown | 0.0 | >=7.6.0 and <7.6.16 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.6.1 | 7.6.16, 8.6.1 |
| 2017-09-05-1 | Cross-Site Scripting in TYPO3 CMS Backend | unknown | 0.0 | >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.7.5 | 8.7.5 |
| 2017-09-05-2 | Information Disclosure in TYPO3 CMS | unknown | 0.0 | >=7.6.0 and <7.6.22 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.7.5 | 7.6.22, 8.7.5 |
| 2017-09-05-3 | Information Disclosure in TYPO3 CMS | unknown | 0.0 | >=7.6.0 and <7.6.22 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.7.5 | 7.6.22, 8.7.5 |
| 2017-09-05-4 | Arbitrary Code Execution in TYPO3 CMS | unknown | 0.0 | >=7.6.0 and <7.6.22 or >=8.0.0 and <8.1.0 or >=8.1.0 and <8.2.0 or >=8.2.0 and <8.3.0 or >=8.3.0 and <8.4.0 or >=8.4.0 and <8.5.0 or >=8.5.0 and <8.6.0 or >=8.6.0 and <8.7.0 or >=8.7.0 and <8.7.5 | 7.6.22, 8.7.5 |
| 2018-07-12-1 | Authentication Bypass in TYPO3 CMS | unknown | 0.0 | >=7.0.0 and <7.6.30 or >=8.0.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 7.6.30, 8.7.17, 9.3.2 |
| 2018-07-12-2 | Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS | unknown | 0.0 | >=7.0.0 and <7.6.30 or >=8.0.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 7.6.30, 8.7.17, 9.3.2 |
| 2018-07-12-3 | Privilege Escalation & SQL Injection in TYPO3 CMS | unknown | 0.0 | >=8.5.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 8.7.17, 9.3.2 |
| 2018-07-12-4 | Insecure Deserialization in TYPO3 CMS | unknown | 0.0 | >=8.5.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 8.7.17, 9.3.2 |
| 2018-12-11-1 | Cross-Site Scripting in Online Media Asset Rendering | unknown | 0.0 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| 2018-12-11-2 | Cross-Site Scripting in Backend Modal Component | unknown | 0.0 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| 2018-12-11-3 | Cross-Site Scripting in Frontend User Login | unknown | 0.0 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| 2018-12-11-4 | Security Misconfiguration in Install Tool Cookie | unknown | 0.0 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| 2018-12-11-5 | Information Disclosure in Install Tool | unknown | 0.0 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| 2018-12-11-6 | Denial of Service in Online Media Asset Handling | unknown | 0.0 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 or >=9.0.0 and <9.5.2 | 7.6.32, 8.7.21, 9.5.2 |
| 2018-12-11-7 | Denial of Service in Frontend Record Registration | unknown | 0.0 | >=7.0.0 and <7.6.32 or >=8.0.0 and <8.7.21 | 7.6.32, 8.7.21 |
| 2019-01-22-1 | Information Disclosure of Installed Extensions | unknown | 0.0 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22-2 | Security Misconfiguration for Backend User Accounts | unknown | 0.0 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22-3 | Broken Access Control in Localization Handling | unknown | 0.0 | >=8.0.0 and <8.7.23 | 8.7.23 |
| 2019-01-22-4 | Cross-Site Scripting in Fluid ViewHelpers | unknown | 0.0 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22-6 | Cross-Site Scripting in Form Framework | unknown | 0.0 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22-7 | Arbitrary Code Execution via File List Module | unknown | 0.0 | >=8.0.0 and <8.7.23 or >=9.0.0 and <9.5.4 | 8.7.23, 9.5.4 |
| 2019-01-22-8 | Cross-Site Scripting in Language Pack Handling | unknown | 0.0 | >=9.0.0 and <9.5.4 | 9.5.4 |
| 2019-05-07-2 | Security Misconfiguration in User Session Handling | unknown | 0.0 | >=8.0.0 and <8.7.25 or >=9.0.0 and <9.5.6 | 8.7.25, 9.5.6 |
| 2019-05-07-4 | Information Disclosure in Page Tree | unknown | 0.0 | >=9.0.0 and <9.5.6 | 9.5.6 |
| 2019-05-07-5 | Information Disclosure in User Authentication | unknown | 0.0 | >=9.0.0 and <9.5.6 | 9.5.6 |
| 2019-06-25-1 | Information Disclosure in Backend User Interface | unknown | 0.0 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| 2019-06-25-3 | Security Misconfiguration in Frontend Session Handling | unknown | 0.0 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| 2019-06-25-4 | Arbitrary Code Execution and Cross-Site Scripting in Backend API | unknown | 0.0 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| 2019-06-25-7 | Broken Access Control in Import Module | unknown | 0.0 | >=9.0.0 and <9.5.8 | 9.5.8 |
| 2019-12-17-1 | Cross-Site Scripting in Form Framework validation handling | unknown | 0.0 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| 2019-12-17-2 | Cross-Site Scripting in Link Handling | unknown | 0.0 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| 2019-12-17-3 | Cross-Site Scripting in Filelist Module | unknown | 0.0 | >=10.0.0 and <10.2.1 or >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 10.2.1, 8.7.30, 9.5.12 |
| 2019-12-17-7 | Possible Insecure Deserialization in Extbase Request Handling | unknown | 0.0 | >=8.0.0 and <8.7.30 or >=9.0.0 and <9.5.12 | 8.7.30, 9.5.12 |
| GHSA-259v-xm34-p7fr | Typo3 Cross-Site Scripting in Language Pack Handling | medium | 0.0 | >=9.0.0 and <9.5.4 | 9.5.4 |
| GHSA-3jxq-5xhh-9jr3 | Cross-Site Scripting (XSS) in TYPO3 component Backend | medium | 0.0 | >=6.2.0 and <6.2.19 | 6.2.19 |
| GHSA-5cxf-xx9j-54jc | Multiple Cross-Site Scripting vulnerabilities in TYPO3 backend | medium | 0.0 | >=6.2.0 and <6.2.16 or >=7.0.0 and <7.6.1 | 6.2.16, 7.6.1 |
| GHSA-5j86-5xvg-7q93 | TYPO3 Cross-Site Scripting (XSS) in form component | medium | 0.0 | >=6.2.0 and <6.2.18 | 6.2.18 |
| GHSA-6f9m-v7mp-7jjq | Authentication Bypass in TYPO3 CMS | medium | 0.0 | >=7.0.0 and <7.6.30 or >=8.0.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 7.6.30, 8.7.17, 9.3.2 |
| GHSA-6fc6-cj2j-h22x | TYPO3 Multiple Cross-Site Scripting vulnerabilities in frontend | medium | 0.0 | >=6.2.0 and <6.2.16 or >=7.0.0 and <7.6.1 | 6.2.16, 7.6.1 |
| GHSA-8h28-f46f-m87h | Insecure Deserialization in TYPO3 CMS | high | 0.0 | >=8.5.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 8.7.17, 9.3.2 |
| GHSA-8j9v-4hhh-x43c | Cross-Site Scripting (XSS) in TYPO3 component CSS styled content | medium | 0.0 | >=6.2.0 and <6.2.19 or >=7.6.0 and <7.6.4 | 6.2.19, 7.6.4 |
| GHSA-9895-53fc-98v2 | TYPO3 SQL Injection in dbal | high | 0.0 | >=6.2.0 and <6.2.18 | 6.2.18 |
| GHSA-cg4m-qjjp-7497 | TYPO3 Cross-Site Scripting in link validator component | medium | 0.0 | >=6.2.0 and <6.2.18 or >=7.6.0 and <7.6.3 | 6.2.18, 7.6.3 |
| GHSA-f5rr-9r84-wwqf | Typo3 Broken Access Control in Import Module | medium | 0.0 | >=9.0.0 and <9.5.8 | 9.5.8 |
| GHSA-g4pf-3jvq-2gcw | TYPO3 Remote Code Execution in third party library swiftmailer | high | 0.0 | >=6.2.0 and <6.2.30 or >=7.6.0 and <7.6.15 or >=8.0.0 and <8.5.1 | 6.2.30, 7.6.15, 8.5.1 |
| GHSA-g9rv-6g56-65h8 | Typo3 Security Misconfiguration in User Session Handling | medium | 0.0 | >=8.0.0 and <8.7.25 or >=9.0.0 and <9.5.6 | 8.7.25, 9.5.6 |
| GHSA-gj48-w74w-8gvm | Path Traversal in TYPO3 Core | medium | 0.0 | >=6.2.0 and <6.2.29 or >=7.6.0 and <7.6.13 or >=8.0.0 and <8.4.1 | 6.2.29, 7.6.13, 8.4.1 |
| GHSA-h934-f4m4-wc8x | Typo3 Information Disclosure in Page Tree | low | 0.0 | >=9.0.0 and <9.5.6 | 9.5.6 |
| GHSA-hq37-rfjc-mr8h | Cross-Site Scripting (XSS) in TYPO3 Backend | medium | 0.0 | >=6.2.0 and <6.2.27 or >=7.6.0 and <7.6.11 or >=8.0.0 and <8.3.1 | 6.2.27, 7.6.11, 8.3.1 |
| GHSA-hww5-6x85-mc24 | Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API | medium | 0.0 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| GHSA-m96r-7vqm-j95g | Typo3 Information Disclosure in User Authentication | medium | 0.0 | >=9.0.0 and <9.5.6 | 9.5.6 |
| GHSA-p5c5-gmj4-g48f | Cross-Site Scripting (XSS) vulnerability in typolinks | medium | 0.0 | >=6.2.0 and <6.2.26 or >=7.6.0 and <7.6.10 or >=8.0.0 and <8.2.1 | 6.2.26, 7.6.10, 8.2.1 |
| GHSA-p84g-j2gh-83g3 | TYPO3 possible cache poisoning on the homepage when anchors are used | high | 0.0 | >=6.2.0 and <6.2.9 or >=7.0.0 and <7.0.2 | 6.2.9, 7.0.2 |
| GHSA-pmxp-7224-h794 | Denial of Service (DoS) attack possibility in TYPO3 component Indexed Search | medium | 0.0 | >=6.2.0 and <6.2.19 or >=7.6.0 and <7.6.4 | 6.2.19, 7.6.4 |
| GHSA-ppgf-8745-8pgx | Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS | high | 0.0 | >=7.0.0 and <7.6.30 or >=8.0.0 and <8.7.17 or >=9.0.0 and <9.3.2 | 7.6.30, 8.7.17, 9.3.2 |
| GHSA-q9c4-9v5m-597p | Typo3 Information Disclosure in Backend User Interface | medium | 0.0 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| GHSA-qffc-gwpp-m2xr | XML External Entity (XXE) Processing in TYPO3 Core | high | 0.0 | >=6.2.0 and <6.2.19 or >=7.6.0 and <7.6.4 | 6.2.19, 7.6.4 |
| GHSA-qmwf-j7g7-f5jw | Cross-Site Scripting in third party library mso/idna-convert | medium | 0.0 | >=7.6.0 and <7.6.10 or >=8.0.0 and <8.2.1 | 7.6.10, 8.2.1 |
| GHSA-qr5f-6fcv-w69q | Typo3 Security Misconfiguration in Frontend Session Handling | medium | 0.0 | >=8.0.0 and <8.7.27 or >=9.0.0 and <9.5.8 | 8.7.27, 9.5.8 |
| GHSA-qrxh-46mr-pr7q | TYPO3 is susceptible to Cross-Site Flashing | medium | 0.0 | >=6.2.0 and <6.2.16 | 6.2.16 |
| GHSA-vgm8-r9gm-fw59 | TYPO3 Cross-Site Scripting in legacy form component | medium | 0.0 | >=6.2.0 and <6.2.18 | 6.2.18 |
| GHSA-wh8q-72cp-p5wf | Cross-Site Scripting in TYPO3 component Indexed Search | medium | 0.0 | >=6.2.0 and <6.2.16 | 6.2.16 |
| GHSA-wrpf-2x8h-82gr | Typo3 Arbitrary File Disclosure in Form Component | medium | 0.0 | >=6.2.0 and <6.2.20 | 6.2.20 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked