CVEs we hold for Typo3

Records whose assigning authority named Typo3 as the affected vendor. Newest identifiers first, capped at 200.

CVE-2026-8827SQL Injection in extension "Address List" (tt_address)TYPO3 Extension "Address List"

CVE-2026-8727Remote Code Execution in extension "Site Crawler" (crawler)TYPO3 Extension "Site Crawler"

CVE-2026-8726SQL Injection in extension "News system" (news)TYPO3 Extension "News system"

CVE-2026-85400TYPO3 CMS - Missing Authorization in lowlevel commandsTYPO3 CMS

CVE-2026-77146Broken Access Control in extension "femanager" (femanager)TYPO3 Extension "femanager"

CVE-2026-77145Broken Access Control in extension "Events 2" (events2)TYPO3 Extension "Events 2"

CVE-2026-77144Broken Access Control in extension "Events 2" (events2)TYPO3 Extension "Events 2"

CVE-2026-77143Broken Access Control in extension "Forum" (pforum)TYPO3 Extension "Forum"

CVE-2026-77142Broken Access Control in extension "Industry Directory" (yellowpages2)TYPO3 Extension "Industry Directory"

CVE-2026-77141Broken Access Control in extension "Club Directory" (clubdirectory)TYPO3 Extension "Club Directory"

CVE-2026-77140Broken Access Control in extension "Telephone Directory" (telephonedirectory)TYPO3 Extension "Telephone Directory"

CVE-2026-77139Path Traversal in extension "Mask" (mask)TYPO3 Extension "Mask"

CVE-2026-77138Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)TYPO3 Extension "HTML5 Video Player vs. Powermail"

CVE-2026-77137SQL Injection in extension "Forms Export" (frp_form_answers)TYPO3 Extension "Forms Export"

CVE-2026-77136Server-Side Template Injection in extension "powermail" (powermail)TYPO3 Extension "powermail"

CVE-2026-77135Information Disclosure in extension "femanager" (femanager)TYPO3 Extension "femanager"

CVE-2026-77134Broken Access Control in extension "femanager" (femanager)TYPO3 Extension "femanager"

CVE-2026-77133Broken Access Control in extension "femanager" (femanager)TYPO3 Extension "femanager"

CVE-2026-77132TYPO3 CMS - Information Disclosure via Backend Localization WizardTYPO3 CMS

CVE-2026-77131Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)TYPO3 Monitoring & Security Checks"

CVE-2026-77130Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)TYPO3 Monitoring & Security Checks"

CVE-2026-77129Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)TYPO3 Extension "Event management and registration"

CVE-2026-77128Broken Access Control in extension "Event management and registration" (sf_event_mgt)TYPO3 Extension "Event management and registration"

CVE-2026-77127Information Disclosure in extension "Modules" (modules)TYPO3 Extension "Modules"

CVE-2026-6553TYPO3 CMS Stores Cleartext Password in User Settings ModuleTYPO3 CMS

CVE-2026-56096Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)TYPO3 - Enterprise Search"

CVE-2026-56095Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)TYPO3 - Enterprise Search"

CVE-2026-56094Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)TYPO3 - Enterprise Search"

CVE-2026-56093Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)TYPO3 - Enterprise Search"

CVE-2026-56092Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)TYPO3 - Enterprise Search"

CVE-2026-49742TYPO3 CMS - Broken Access Control in Media ModuleTYPO3 CMS

CVE-2026-49741TYPO3 CMS - Privilege Escalation & SQL Injection in Form FrameworkTYPO3 CMS

CVE-2026-49740TYPO3 CMS - Insecure Deserialization in Core APITYPO3 CMS

CVE-2026-49738TYPO3 CMS - Broken Access Control in File Abstraction LayerTYPO3 CMS

CVE-2026-47352TYPO3 CMS - Broken Access Control in Backend APITYPO3 CMS

CVE-2026-47351TYPO3 CMS - Broken Access Control in ClipboardTYPO3 CMS

CVE-2026-47350TYPO3 CMS - Broken Access Control in DataHandlerTYPO3 CMS

CVE-2026-47349TYPO3 CMS - Broken Access Control in RecyclerTYPO3 CMS

CVE-2026-47348TYPO3 CMS - Cross-Site Scripting in Indexed SearchTYPO3 CMS

CVE-2026-47347TYPO3 CMS - Open Redirect in Core UtilitiesTYPO3 CMS

CVE-2026-47346TYPO3 CMS - Broken Access Control in Form FrameworkTYPO3 CMS

CVE-2026-47345TYPO3 HTML Sanitizer allows Cross-Site ScriptingTYPO3 HTML Sanitizer

CVE-2026-47344TYPO3 HTML Sanitizer allows Cross-Site ScriptingTYPO3 HTML Sanitizer

CVE-2026-47343TYPO3 CMS - Destructive Actions on File Mount FoldersTYPO3 CMS

CVE-2026-46725Remote Code Execution in extension "Content Element Selector" (ceselector)TYPO3 Extension "Content Element Selector"

CVE-2026-46724Path Traversal in extension "Faceted Search" (ke_search)TYPO3 Extension "Faceted Search"

CVE-2026-46723Information Disclosure in extension "Faceted Search" (ke_search)TYPO3 Extension "Faceted Search"

CVE-2026-46722XML External Entity Injection in extension "Faceted Search" (ke_search)TYPO3 Extension "Faceted Search"

CVE-2026-46721Broken Access Control in extension "Frontend User Registration" (sf_register)TYPO3 Extension "Frontend User Registration"

CVE-2026-4208Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)TYPO3 Extension "E-Mail MFA Provider"

CVE-2026-4202Broken Access Control in extension "Redirect Tab"TYPO3 Extension "Redirect Tabs"

CVE-2026-19418TYPO3 CMS - Broken Access Control in Backend and Install ToolTYPO3 CMS

CVE-2026-15305TYPO3 CMS - Unrestricted File Upload in Form FrameworkTYPO3 CMS

CVE-2026-1323Insecure Deserialization in extension "Mailqueue" (mailqueue)TYPO3 Extension "Mailqueue"

CVE-2026-11607TYPO3 CMS - Broken Access Control in Form FrameworkTYPO3 CMS

CVE-2026-0895Insecure Deserialization in extension "Mailqueue" (mailqueue)TYPO3 Extension "Mailqueue"

CVE-2026-0859TYPO3 CMS Allows Insecure Deserialization via Mailer File SpoolTYPO3 CMS

CVE-2025-9573Command Injection in extension "TYPO3 Backup Plus" (ns_backup)TYPO3 Extension "TYPO3 Backup Plus"

CVE-2025-7900Insecure Direct Object Reference in extension "femanager" (femanager)TYPO3 Extension "femanager"

CVE-2025-7899Insecure Direct Object Reference in extension "powermail" (powermail)TYPO3 Extension "powermail"

CVE-2025-59022TYPO3 CMS Allows Broken Access Control in Recycler ModuleTYPO3 CMS

CVE-2025-59021TYPO3 CMS Allows Broken Access Control in Redirects ModuleTYPO3 CMS

CVE-2025-59020TYPO3 CMS Allows Broken Access Control in Edit Document ControllerTYPO3 CMS

CVE-2025-59019Information Disclosure via CSV DownloadTYPO3 CMS

CVE-2025-59018Information Disclosure in Workspaces ModuleTYPO3 CMS

CVE-2025-59017Broken Access Control in Backend AJAX RoutesTYPO3 CMS

CVE-2025-59016Information Disclosure via File Abstraction LayerTYPO3 CMS

CVE-2025-59015Insufficient Entropy in Password GenerationTYPO3 CMS

CVE-2025-59014Denial of Service in TYPO3 Bookmark ToolbarTYPO3 CMS

CVE-2025-59013Open Redirect in TYPO3 CMSTYPO3 CMS

CVE-2025-48207no title heldTYPO3 reint downloadmanager extension

CVE-2025-48206no title heldTYPO3 ns backup extension

CVE-2025-48205no title heldTYPO3 sr feuser register extension

CVE-2025-48204no title heldTYPO3 ns backup extension

CVE-2025-48203no title heldTYPO3 cs seo extension

CVE-2025-48202no title heldTYPO3 femanager extension

CVE-2025-48201no title heldTYPO3 ns backup extension

CVE-2025-48200no title heldTYPO3 sr feuser register extension

CVE-2025-47941TYPO3 Has Broken Authentication in Backend MFAtypo3

CVE-2025-47940TYPO3 CMS Vulnerable to Privilege Escalation to System Maintainertypo3

CVE-2025-47939TYPO3 CMS Vulnerable to Unrestricted File Upload in File Abstraction Layertypo3

CVE-2025-47938TYPO3 Vulnerable to Unverified Password Change for Backend Userstypo3

CVE-2025-47937TYPO3 Vulnerable to Information Disclosure via DBAL Restriction Handlingtypo3

CVE-2025-47936TYPO3 Vulnerable to Server Side Request Forgery via Webhookstypo3

CVE-2025-24856no title heldTYPO3 oidc

CVE-2025-12998Broken Authentication in extension “Modules” (modules)TYPO3 Extension "Modules"

CVE-2025-10316Cross-Site Scripting in extension "Form to Database" (form_to_database)TYPO3 Extension "Form to Database" (form_to_database)

CVE-2024-55945Cross-Site Request Forgery in DB Check Module in TYPO3typo3

CVE-2024-55924Cross-Site Request Forgery in Scheduler Module in TYPO3typo3

CVE-2024-55923Cross-Site Request Forgery in Indexed Search Module in TYPO3typo3

CVE-2024-55922Cross-Site Request Forgery in Form Framework Module in TYPO3typo3

CVE-2024-55921Cross-Site Request Forgery in Extension Manager Module in TYPO3typo3

CVE-2024-55920Cross-Site Request Forgery in Dashboard Module in TYPO3typo3

CVE-2024-55894TYPO3 Cross-Site Request Forgery in Backend User Moduletypo3

CVE-2024-55893TYPO3 Cross-Site Request Forgery in Log Moduletypo3

CVE-2024-55892Potential Open Redirect via Parsing Differences in TYPO3typo3

CVE-2024-55891Information Disclosure via Exception Handling/Logger in TYPO3typo3

CVE-2024-47780Information Disclosure in TYPO3 Page Treetypo3

CVE-2024-34358TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageControllertypo3

CVE-2024-34357TYPO3 vulnerable to Cross-Site Scripting in ShowImageControllertypo3

CVE-2024-34356TYPO3 vulnerable to Cross-Site Scripting in the Form Manager Moduletypo3

CVE-2024-34355TYPO3 vulnerable to an HTML Injection in the History Moduletypo3

CVE-2024-25121Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3typo3

CVE-2024-25120Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3typo3

CVE-2024-25119Information Disclosure of Encryption Key in TYPO3 Install Tooltypo3

CVE-2024-25118Information Disclosure of Hashed Passwords in TYPO3 Backend Formstypo3

CVE-2023-50462no title heldTYPO3 content_consent

CVE-2023-50461no title heldTYPO3 direct_mail

CVE-2023-50460no title heldTYPO3 femanager

CVE-2023-50459no title heldTYPO3 femanager

CVE-2023-47127Weak Authentication in Session Handling in typo3/cms-coretypo3

CVE-2023-47126Information Disclosure in Install Tool in typo3/cms-installtypo3

CVE-2023-47125By-passing Cross-Site Scripting Protection in HTML SanitizerTYPO3 html-sanitizer

CVE-2023-45023no title heldTYPO3 femanager

CVE-2023-38500By-passing Cross-Site Scripting Protection in HTML SanitizerTYPO3 html-sanitizer

CVE-2023-38499typo3/cms-core Information Disclosure due to Out-of-scope Site Resolutiontypo3

CVE-2023-24814Persisted Cross-Site Scripting in Frontend Rendering in typo3typo3

CVE-2022-36108Cross-Site Scripting in typo3/cms-coretypo3

CVE-2022-36107Stored Cross-Site Scripting via FileDumpControllertypo3

CVE-2022-36106Missing check for expiration time of password reset token in TYPO3typo3

CVE-2022-36105User Enumeration via Response Timing in TYPO3typo3

CVE-2022-36104Denial of Service via Page Error Handling in TYPO3/cmstypo3

CVE-2022-36020Bypass of Cross-Site Scripting Protection in typo3/html-sanitizerTYPO3 html-sanitizer

CVE-2022-31050Insufficient Session Expiration in TYPO3 Admin Tooltypo3

CVE-2022-31049Cross-Site Scripting in Frontend Login Mailertypo3

CVE-2022-31048Cross-Site Scripting in Form Frameworktypo3

CVE-2022-31047Insertion of Sensitive Information into Log File in typo3/cms-coretypo3

CVE-2022-31046Information Disclosure via Export Module in TYPO3 CMStypo3

CVE-2022-23504TYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site Configurationtypo3

CVE-2022-23503TYPO3 vulnerable to Arbitrary Code Execution via Form Frameworktypo3

CVE-2022-23502TYPO3 contains Insufficient Session Expiration after Password Resettypo3

CVE-2022-23501TYPO3 vulnerable to Improper Authentication in Frontend Logintypo3

CVE-2022-23500TYPO3 subject to Uncontrolled Recursion resulting in Denial of Servicetypo3

CVE-2022-23499Cross-Site Scripting Protection bypass in HTML SanitizerTYPO3 html-sanitizer

CVE-2021-41114HTTP Host Header Injection in Request Handling in Typo3typo3

CVE-2021-41113Cross-Site-Request-Forgery in Backend URI Handling in Typo3typo3

CVE-2021-32768Cross-Site Scripting via Rich-Text ContentTYPO3 TYPO3.CMS

CVE-2021-32767Information Disclosure in User AuthenticationTYPO3 TYPO3.CMS

CVE-2021-32669Cross-Site Scripting in Backend Grid ViewTYPO3 TYPO3.CMS

CVE-2021-32668Cross-Site Scripting in Query Generator & Query ViewTYPO3 TYPO3.CMS

CVE-2021-32667Cross-Site Scripting in Page PreviewTYPO3 TYPO3.CMS

CVE-2021-21370Cross-Site Scripting in Content Preview (CType menu)TYPO3 TYPO3.CMS

CVE-2021-21359Denial of Service in Page Error HandlingTYPO3 TYPO3.CMS

CVE-2021-21358Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-formTYPO3 TYPO3.CMS

CVE-2021-21357Broken Access Control in Form FrameworkTYPO3 TYPO3.CMS

CVE-2021-21355Unrestricted File Upload in Form FrameworkTYPO3 TYPO3.CMS

CVE-2021-21340Cross-Site Scripting in Content PreviewTYPO3 TYPO3.CMS

CVE-2021-21339Cleartext storage of session identifierTYPO3 TYPO3.CMS

CVE-2021-21338Open Redirection in Login HandlingTYPO3 TYPO3.CMS

CVE-2020-26229XML External Entity in Dashboard WidgetTYPO3 TYPO3.CMS

CVE-2020-26228Cleartext storage of session identifierTYPO3 TYPO3.CMS

CVE-2020-26227Cross-Site Scripting in Fluid view helpersTYPO3 TYPO3.CMS

CVE-2020-26216Cross-Site Scripting in TYPO3 FluidTYPO3 Fluid

CVE-2020-15241Cross-Site Scripting in TYPO3 Fluid EngineTYPO3 Fluid

CVE-2020-15099Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMSTYPO3 CMS

CVE-2020-15098Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMSTYPO3 CMS

CVE-2020-11070Cross-Site Scripting in SVG SanitizerTYPO3GmbH svg_sanitizer

CVE-2020-11069Cross-Site Request Forgery in TYPO3 CMSTYPO3 CMS

CVE-2020-11067Deserialization of Untrusted Data in TYPO3 CMSTYPO3 CMS

CVE-2020-11066Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMSTYPO3 CMS

CVE-2020-11065Cross-Site Scripting in TYPO3 CMSTYPO3 CMS

CVE-2020-11064Cross-Site Scripting in TYPO3 CMSTYPO3 CMS

CVE-2020-11063Observable Response Discrepancy in TYPO3 CMSTYPO3 CMS

CVE-2011-4904no title heldTYPO3

CVE-2011-4903no title heldTYPO3

CVE-2011-4902no title heldTYPO3

CVE-2011-4901no title heldTYPO3

CVE-2011-4900no title heldTYPO3

CVE-2011-4632no title heldTYPO3

CVE-2011-4631no title heldTYPO3

CVE-2011-4630no title heldTYPO3

CVE-2011-4629no title heldTYPO3

CVE-2011-4628no title heldTYPO3

CVE-2011-4627no title heldTYPO3

CVE-2011-4626no title heldTYPO3

CVE-2011-3584no title heldTYPO3 Core wec_discussion

CVE-2011-3583no title heldTYPO3 Core

177 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.