Typo3 Security Vulnerabilities (CVEs)

This CVE describes an authorization bypass vulnerability in TYPO3 CMS where backend users with redirect module access and write permissions could mani...

This vulnerability allows backend users with access to the recycler module to delete arbitrary data from any database table defined in TYPO3's TCA, re...

This CVE describes a deserialization vulnerability in TYPO3 CMS mail file spool functionality. Local users with write access to the spool directory ca...

This vulnerability allows authenticated TYPO3 backend users with write permissions to bypass field-level access controls during record creation. By ex...

This vulnerability allows authenticated backend users in TYPO3 CMS to download CSV files containing data from database tables they shouldn't have acce...

This vulnerability in TYPO3 CMS's password generation component uses a predictable three-character prefix, reducing randomness and making brute-force ...

This vulnerability allows authenticated backend users in TYPO3 CMS to obtain sensitive file path information through error messages when file operatio...

This vulnerability allows authenticated backend users in TYPO3 CMS to bypass authorization checks and directly access AJAX backend routes they shouldn...

An open-redirect vulnerability in TYPO3 CMS's GeneralUtility::sanitizeLocalUrl function allows attackers to redirect users to malicious external websi...

The femanager extension for TYPO3 contains an Insecure Direct Object Reference vulnerability that allows attackers to modify user data without proper ...

This vulnerability in TYPO3's file management module allows backend users to upload potentially harmful files like executables or files with mismatche...

This vulnerability allows TYPO3 administrator-level backend users without system maintainer privileges to escalate their privileges and gain system ma...

This CSRF vulnerability in TYPO3's backend allows attackers to manipulate or delete form definitions when authenticated backend users interact with ma...

This CSRF vulnerability in TYPO3's backend allows attackers to trick authenticated backend users into executing unauthorized actions via malicious lin...

This CSRF vulnerability in TYPO3's backend user interface allows attackers to trick authenticated backend users into performing unauthorized state-cha...

This CSRF vulnerability in TYPO3's backend user interface allows attackers to perform unauthorized password resets or session terminations for other b...

This CSRF vulnerability in TYPO3's backend allows attackers to trick authenticated backend users into performing unauthorized actions via malicious li...

This vulnerability in TYPO3's URI parsing component allows attackers to bypass host validation checks when processing externally provided URLs. This c...

This vulnerability in TYPO3's ShowImageController allows attackers to trigger unlimited thumbnail generation by manipulating the 'frame' parameter wit...

This CVE describes a cross-site scripting (XSS) vulnerability in TYPO3's form manager backend module. It allows authenticated backend users with form ...

This CVE describes a command injection vulnerability in TYPO3's Install Tool that allows authenticated admin users with system maintainer privileges t...

This vulnerability in TYPO3 allows authenticated backend users to access files in the fallback storage via the File Abstraction Layer, potentially exp...

This vulnerability allows unauthenticated attackers to upload arbitrary files with any extension to TYPO3 CMS servers. It affects TYPO3 installations ...