Search for packages
| purl | pkg:composer/typo3/cms-core@8.7.22 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-rgcg-28xm-8mmw
Aliases: CVE-2021-32669 |
Cross-Site Scripting in Backend Grid View ### Problem Failing to properly encode settings for _backend layouts_, the corresponding grid view … | There are no reported fixed by versions. |
|
GHSA-34fr-fhqr-7235
Aliases: CVE-2021-32767 |
Information Disclosure in User Authentication > ### Meta > * CVSS: `AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered that … | There are no reported fixed by versions. |
|
GHSA-6mh3-j5r5-2379
Aliases: CVE-2021-32668 |
Cross-Site Scripting in Query Generator & Query View > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.5) ### Problem Failing to … | There are no reported fixed by versions. |
|
GHSA-c5c9-8c6m-727v
Aliases: CVE-2021-32768 |
Cross-Site Scripting via Rich-Text Content > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC` (5.7) ### Problem Failing to properly parse, sanitize … | There are no reported fixed by versions. |
|
GHSA-jfp7-79g7-89rf
Aliases: CVE-2022-23501 |
TYPO3 CMS vulnerable to Weak Authentication in Frontend Login ### Problem Restricting frontend login to specific users, organized in different … | There are no reported fixed by versions. |
|
GHSA-c5wx-6c2c-f7rm
Aliases: CVE-2022-23503 |
TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework ### Problem Due to the lack of separating user-submitted data … | There are no reported fixed by versions. |
|
GHSA-8gmv-9hwg-w89g
Aliases: CVE-2022-31046 |
Information Disclosure via Export Module > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (4.0) ### Problem The export functionality fails to … | There are no reported fixed by versions. |
|
GHSA-3r95-23jp-mhvg
Aliases: CVE-2022-31048 |
Cross-Site Scripting in TYPO3's Form Framework > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It has been discovered … | There are no reported fixed by versions. |
|
GHSA-fh99-4pgr-8j99
Aliases: CVE-2022-31047 |
Insertion of Sensitive Information into Log File in typo3/cms-core > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It … | There are no reported fixed by versions. |
|
GHSA-86hp-xrhj-fhpq
Aliases: CVE-2019-12747 |
TYPO3 Vulnerable to Insecure Deserialization TYPO3 8.x through 8.7.26 and 9.x through 9.5.7 allows Deserialization of Untrusted Data. |
Vulnerable |
|
GHSA-r6fv-56gp-j3r4
Aliases: CVE-2019-12748 |
Typo3 Cross-Site Scripting in Link Handling TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS. |
Vulnerable |
|
GHSA-m392-235j-9r7r
Aliases: CVE-2022-36105 |
TYPO3 CMS vulnerable to User Enumeration via Response Timing > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C` (4.9) ### Problem It … | There are no reported fixed by versions. |
|
GHSA-9c6w-55cp-5w25
Aliases: CVE-2022-36107 |
TYPO3 CMS Stored Cross-Site Scripting via FileDumpController > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.0) ### Problem It has been … | There are no reported fixed by versions. |
|
GHSA-f9hr-7cfq-mjg2
|
TYPO3 Arbitrary Code Execution via File List Module Due to missing file extensions in $GLOBALS['TYPO3_CONF_VARS']['BE'][‘fileDenyPattern’], backend users are allowed to … |
Vulnerable |
|
GHSA-p2h4-7fp3-cmh8
|
TYPO3 Disclosure of Information about Installed Extensions It has been discovered that mechanisms used for configuration of RequireJS package loading … |
Vulnerable |
|
GHSA-x428-565f-8xj2
|
TYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend API Backend API configuration using Page TSconfig is vulnerable to arbitrary … |
Vulnerable |
|
GHSA-82vp-jr39-4j2j
|
TYPO3 Security Misconfiguration in Frontend Session Handling It has been discovered session data of properly authenticated and logged in frontend … |
Vulnerable |
|
GHSA-95qm-3xp7-vfj5
|
TYPO3 Cross-Site Scripting in Form Framework validation handling It has been discovered that the output of field validation errors in … |
Vulnerable |
|
GHSA-4459-qrcc-vfcf
|
TYPO3 Cross-Site Scripting in Form Framework Failing to properly encode user input, frontend forms handled by the form framework (system … |
Vulnerable |
|
GHSA-5h5v-m596-r6rf
|
TYPO3 Possible Insecure Deserialization in Extbase Request Handling It has been discovered that request handling in Extbase can be vulnerable … |
Vulnerable |
|
GHSA-9rx9-7fmh-gj3g
|
TYPO3 Broken Access Control in Localization Handling It has been discovered that backend users having limited access to specific languages … |
Vulnerable |
|
GHSA-xmgr-jff3-fcfv
|
TYPO3 Security Misconfiguration in User Session Handling When users change their password existing sessions for that particular user account are … |
Vulnerable |
|
GHSA-rv8r-8mh5-5376
|
TYPO3 Information Disclosure in Backend User Interface The element information component used to display properties of a certain record is … |
Vulnerable |
|
GHSA-rxc9-f2x6-qh4w
|
TYPO3 Security Misconfiguration for Backend User Accounts When using the TYPO3 backend in order to create new backend user accounts, … |
Vulnerable |
|
GHSA-6xwf-7rfm-4gwc
|
TYPO3 Cross-Site Scripting in Filelist Module It has been discovered that the output table listing in the “Files” backend module … |
Vulnerable |
|
GHSA-4ppr-jw47-9qm5
|
TYPO3 Cross-Site Scripting in Link Handling It has been discovered that t3:// URL handling and typolink functionality are vulnerable to … |
Vulnerable |
|
GHSA-r4f8-f93x-5qh3
Aliases: CVE-2023-24814 |
TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering > ### CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:F/RL:O/RC:C` (8.2) ### Problem TYPO3 core component `GeneralUtility::getIndpEnv()` … | There are no reported fixed by versions. |
|
GHSA-hwvq-2w67-rvxp
Aliases: CVE-2026-47346 |
TYPO3 CMS has Broken Access Control in its Form Framework ### Problem Backend users with file write permissions were able … | There are no reported fixed by versions. |
|
GHSA-pjpj-v387-x4vq
Aliases: CVE-2026-11607 |
TYPO3 CMS has Broken Access Control in its Form Framework ### Problem Backend users with access to the Form Framework … | There are no reported fixed by versions. |
|
GHSA-3v8v-4wg6-r7qh
Aliases: CVE-2026-47343 |
TYPO3 CMS: Destructive Actions on File Mount Folders ### Problem Non-privileged backend users with file mount access were able to … | There are no reported fixed by versions. |
|
GHSA-f34x-rx2w-7pm3
Aliases: CVE-2026-47349 |
TYPO3 CMS has Broken Access Control in the Recycler Module ### Problem Backend users with access to the Recycler module … | There are no reported fixed by versions. |
|
GHSA-3p42-w5ch-gg42
Aliases: CVE-2026-47347 |
TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities ### Problem Applications that use `GeneralUtility::sanitizeLocalUrl` to allow only local … | There are no reported fixed by versions. |
|
GHSA-2j54-93q2-3hjq
Aliases: CVE-2026-47352 |
TYPO3 CMS has Broken Access Control in Backend API ### Problem Authenticated backend users were able to retrieve file metadata … | There are no reported fixed by versions. |
|
GHSA-c78m-c52x-jgwp
Aliases: CVE-2026-49740 |
TYPO3 CMS has Insecure Deserialization via Core API ### Problem TYPO3's cache frontend (`VariableFrontend`) and persistent key-value store (`Registry`) deserialized … | There are no reported fixed by versions. |
|
GHSA-q93m-25xv-94hh
Aliases: CVE-2026-47351 |
TYPO3 CMS: Broken Access Control in Media Module ### Problem Backend users were able to insert arbitrary records and files … | There are no reported fixed by versions. |
|
GHSA-jf56-v8jc-jcc5
Aliases: CVE-2026-49738 |
TYPO3 CMS has Broken Access Control in its File Abstraction Layer ### Problem The path allowance check in `GeneralUtility::isAllowedAbsPath()` performed … | There are no reported fixed by versions. |
|
GHSA-954j-f27r-cj52
Aliases: CVE-2020-26228 |
Cleartext storage of session identifier User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. … | There are no reported fixed by versions. |
|
GHSA-7733-hjv6-4h47
Aliases: CVE-2020-15241 |
Cross-Site Scripting in ternary conditional operator > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C`(5.0) > * CWE-79 --- :information_source: This vulnerability … |
Vulnerable |
|
GHSA-vqqx-jw6p-q3rf
Aliases: CVE-2020-26227 |
Cross-Site Scripting in Fluid view helpers > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) > * CWE-79 ### Problem It … | There are no reported fixed by versions. |
|
CVE-2021-32767
Aliases: GHSA-34fr-fhqr-7235 |
Inclusion of Sensitive Information in Log Files TYPO3 is an open source PHP based web content management system. User credentials … |
Vulnerable Vulnerable Vulnerable |
|
GMS-2019-165
|
Information Disclosure in Backend User Interface. |
Vulnerable Vulnerable |
|
GMS-2019-153
|
Security Misconfiguration for Backend User Accounts. |
Vulnerable Vulnerable |
|
GMS-2019-167
|
Security Misconfiguration in Frontend Session Handling. |
Vulnerable Vulnerable |
|
GMS-2019-154
|
Improper Access Control Broken Access Control in Localization Handling. |
Vulnerable |
|
CVE-2021-21357
Aliases: GHSA-3vg7-jw9m-pc3f |
Path Traversal Due to improper input validation, attackers can by-pass restrictions of predefined options and submit arbitrary data in the … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-22q7-cg4r-p9mx
|
TYPO3 Cross-Site Scripting in Fluid ViewHelpers Failing to properly encode user input, templates using built-in Fluid ViewHelpers are vulnerable to … |
Vulnerable Vulnerable |
|
CVE-2021-32768
Aliases: GHSA-c5c9-8c6m-727v |
Cross-site Scripting TYPO3 is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially … |
Vulnerable Vulnerable Vulnerable |
|
GMS-2019-157
|
Cross-site Scripting Cross-Site Scripting in Form Framework. |
Vulnerable Vulnerable |
|
GMS-2019-156
|
Cross-site Scripting Cross-Site Scripting in Bootstrap CSS toolkit. |
Vulnerable Vulnerable |
|
GMS-2019-162
|
Code Injection Possible Arbitrary Code Execution in Image Processing. |
Vulnerable Vulnerable |
|
GMS-2019-161
|
Security Misconfiguration in User Session Handling. |
Vulnerable Vulnerable |
|
GMS-2019-166
|
Cross-site Scripting Cross-Site Scripting in Link Handling. |
Vulnerable Vulnerable |
|
GMS-2019-152
|
Information Disclosure of Installed Extensions. |
Vulnerable Vulnerable |
|
CVE-2021-32669
Aliases: GHSA-rgcg-28xm-8mmw |
Cross-site Scripting TYPO3 is an open source PHP based web content management system. have a cross-site scripting vulnerability. When settings … |
Vulnerable Vulnerable |
|
CVE-2021-21338
Aliases: GHSA-4jhw-2p6j-5wmp |
URL Redirection to Untrusted Site (Open Redirect) Login Handling is susceptible to open redirection which allows attackers redirecting to arbitrary … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2020-26227
Aliases: GHSA-vqqx-jw6p-q3rf |
Cross-site Scripting TYPO3 is an open source PHP based web content management system. In TYPO3 the system extension Fluid (typo3/cms-fluid) … |
Vulnerable Vulnerable |
|
CVE-2021-32668
Aliases: GHSA-6mh3-j5r5-2379 |
Cross-site Scripting TYPO3 contains a cross-site scripting vulnerability. When error messages are not properly encoded, the components `_QueryGenerator_` and `_QueryView_` … |
Vulnerable Vulnerable |
|
CVE-2021-21370
Aliases: GHSA-x7hc-x7fm-f7qh |
Cross-site Scripting TYPO3 content elements of type `_menu_` are vulnerable to cross-site scripting when their referenced items get previewed in … |
Vulnerable Vulnerable Vulnerable |
|
GMS-2019-160
|
Cross-site Scripting Cross-Site Scripting in Fluid Engine. |
Vulnerable Vulnerable |
|
GMS-2019-155
|
Cross-site Scripting Cross-Site Scripting in Fluid `ViewHelpers`. |
Vulnerable Vulnerable |
|
GMS-2019-168
|
Code Injection Arbitrary Code Execution and Cross-Site Scripting in Backend API. |
Vulnerable Vulnerable |
|
GMS-2019-169
|
Insecure Deserialization in TYPO3 CMS. |
Vulnerable Vulnerable |
|
GMS-2019-158
|
Code Injection Arbitrary Code Execution via File List Module. |
Vulnerable Vulnerable |
|
CVE-2021-21339
Aliases: GHSA-qx3w-4864-94ch |
Cleartext Storage of Sensitive Information User session identifiers were stored in cleartext - without processing of additional cryptographic hashing algorithms. … |
Vulnerable Vulnerable Vulnerable |
|
CVE-2021-21355
Aliases: GHSA-2r6j-862c-m2v2 |
Unrestricted Upload of File with Dangerous Type Due to the lack of ensuring file extensions belong to configured allowed mime-types, … |
Vulnerable Vulnerable Vulnerable |
|
GHSA-pj7m-g53m-7638
Aliases: CVE-2018-14041 |
Bootstrap Cross-site Scripting vulnerability In Bootstrap 4.x before 4.1.2, XSS is possible in the data-target property of scrollspy. This is … |
Vulnerable Vulnerable |
|
GHSA-59pj-7mjh-4465
Aliases: CVE-2019-19850 |
TYPO3 SQL Injection in low-level Query Generator An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x … |
Vulnerable Vulnerable |
|
GHSA-rcgc-4xfc-564v
Aliases: CVE-2019-19849 |
TYPO3 Insecure Deserialization in Query Generator & Query View An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, … |
Vulnerable Vulnerable |
|
GHSA-77p4-wfr8-977w
Aliases: CVE-2019-19848 |
TYPO3 Directory Traversal on ZIP extraction An issue was discovered in TYPO3 before 8.7.30, 9.x before 9.5.12, and 10.x before … |
Vulnerable Vulnerable |
|
GHSA-3w4h-r27h-4r2w
Aliases: CVE-2019-11832 |
TYPO3 Image Processing susceptible to Code Execution TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 is susceptible to remote code … |
Vulnerable Vulnerable |
|
CVE-2022-23501
Aliases: GHSA-jfp7-79g7-89rf GMS-2022-8134 |
TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-36107
Aliases: GHSA-9c6w-55cp-5w25 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is an open source PHP based web content management … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-23503
Aliases: GHSA-c5wx-6c2c-f7rm GMS-2022-8132 |
Improper Control of Generation of Code ('Code Injection') TYPO3 is an open source PHP based web content management system. Versions … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2019-12748
Aliases: GHSA-r6fv-56gp-j3r4 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 8.3.0 through 8.7.26 and 9.0.0 through 9.5.7 allows XSS. |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-31047
Aliases: GHSA-fh99-4pgr-8j99 |
Insertion of Sensitive Information into Log File TYPO3 is an open source web content management system. Prior to versions 7.6.57 … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2024-22188
Aliases: GHSA-5w2h-59j3-8x5w |
TYPO3 Install Tool vulnerable to Code Execution ### Problem Several settings in the Install Tool for configuring the path to … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2023-24814
Aliases: GHSA-r4f8-f93x-5qh3 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') TYPO3 is a free and open source Content Management Framework … |
Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable Vulnerable |
|
CVE-2022-36105
Aliases: GHSA-m392-235j-9r7r |
Observable Discrepancy TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has … |
Vulnerable Vulnerable Vulnerable Vulnerable |
|
GHSA-4jhw-2p6j-5wmp
Aliases: CVE-2021-21338 |
Open Redirection in Login Handling ### Problem It has been discovered that Login Handling is susceptible to open redirection which … | There are no reported fixed by versions. |
|
GHSA-qx3w-4864-94ch
Aliases: CVE-2021-21339 |
Cleartext storage of session identifier ### Problem User session identifiers were stored in cleartext - without processing of additional cryptographic … | There are no reported fixed by versions. |
|
GHSA-gqqf-g5r7-84vf
Aliases: GMS-2022-4096 |
TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection > ### Meta > * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C` (5.7) ### Problem Due to a … |
Vulnerable Vulnerable |
|
GHSA-5w2h-59j3-8x5w
Aliases: CVE-2024-22188 |
TYPO3 Install Tool vulnerable to Code Execution ### Problem Several settings in the Install Tool for configuring the path to … |
Vulnerable Vulnerable |
|
GHSA-wf85-8hx9-gj7c
Aliases: CVE-2024-25120 |
TYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI Scheme ### Problem The TYPO3-specific [`t3://` URI scheme](https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/Functions/Typolink.html#resource-references) … |
Vulnerable Vulnerable |
|
GHSA-h47m-3f78-qp9g
Aliases: CVE-2024-25119 |
TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key ### Problem The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displayed in … |
Vulnerable Vulnerable |
|
GHSA-w6x2-jg8h-p6mp
Aliases: CVE-2023-30451 |
Path Traversal in TYPO3 File Abstraction Layer Storages ### Problem Configurable storages using the local driver of the File Abstraction … |
Vulnerable Vulnerable |
|
GHSA-38r2-5695-334w
Aliases: CVE-2024-25118 |
TYPO3 Backend Forms vulnerable to Information Disclosure of Hashed Passwords ### Problem Password hashes were being reflected in the editing … |
Vulnerable Vulnerable |
|
GHSA-rj3x-wvc6-5j66
Aliases: CVE-2024-25121 |
TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler ### Problem Entities of the File … |
Vulnerable Vulnerable |
|
GHSA-3vmm-7h4j-69rm
Aliases: CVE-2023-47127 |
TYPO3 vulnerable to Weak Authentication in Session Handling > ### CVSS: `CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/E:X/RL:O/RC:C` (4.0) ### Problem Given that there are at … |
Vulnerable Vulnerable |