DemoBook a demo

typo3/cms-backend 9.5.25 vulnerabilities

25 advisories known · typo3/cms-backend@9.5.25 · 3 affect this release · Dependencies not checked

SEVERITYADVISORYPUBLISHED

Affects 9.5.25

SEVERITYADVISORYPUBLISHED
MediumTYPO3 CMS has Broken Access Control in Backend APIGHSA-2j54-93q2-3hjqCVE-2026-47352Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago
MediumTYPO3 CMS: Broken Access Control in Media ModuleGHSA-q93m-25xv-94hhCVE-2026-47351Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago
MediumTYPO3 backend modules have Broken Access ControlGHSA-2fhw-2j7m-mr4mCVE-2025-59017Affected >=13.0.0 <13.4.18, >=9.0.0 <12.4.37Fixed in 12.4.37Fixed in 13.4.18OSV source ↗last year

Does not affect 9.5.25

SEVERITYADVISORYPUBLISHED
HighTYPO3 SQL injection vulnerability on the backendGHSA-4rvc-5hrh-qmwfCVE-2010-3662Affected <4.1.14, >=4.2.0 <4.2.13, >=4.3.0 <4.3.4, >=4.4.0 <4.4.1Fixed in 4.1.14Fixed in 4.2.13Fixed in 4.3.4Fixed in 4.4.1OSV source ↗5 years ago
HighTYPO3 Arbitrary Code Execution vulnerability on the backendGHSA-wjpc-gjf7-9938CVE-2010-3663Affected <4.1.14, >=4.2 <4.2.13, >=4.3 <4.3.4, >=4.4 <4.4.1Fixed in 4.1.14Fixed in 4.2.13Fixed in 4.3.4Fixed in 4.4.1OSV source ↗5 years ago
HighTYPO3 CMS - Broken Access Control in Backend and Install ToolGHSA-68jx-f42c-7599CVE-2026-19418Affected >=13.0.0 <13.4.34Fixed in 13.4.34OSV source ↗2 months ago
HighTYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File NameGHSA-3cqw-pxgr-jhrmCVE-2009-3631Affected <=4.0.13, >=4.1.0 <4.1.13, >=4.2.0 <4.2.10, >=4.3alpha1 <4.3beta2Fixed in 4.1.13Fixed in 4.2.10Fixed in 4.3beta2OSV source ↗5 years ago
HighTYPO3 CMS Stores Cleartext Password in User Settings ModuleGHSA-xvv6-p4wf-mvx7CVE-2026-6553Affected >=14.2.0 <14.3.0Fixed in 14.3.0OSV source ↗7 months ago
HighThe TYPO3 CMS Backend has Broken Authentication in Backend MFAGHSA-744g-7qm9-hjh9CVE-2025-47941Affected >=12.0.0 <12.4.31, >=13.0.0 <13.4.12Fixed in 12.4.31Fixed in 13.4.12OSV source ↗last year
MediumTYPO3 is vulnerable to Information Disclosure on the backendGHSA-8xp9-99h5-4vcgCVE-2010-3664Affected <4.1.14, >=4.2.0 <4.2.13, >=4.3.0 <4.3.4, >=4.4.0 <4.4.1Fixed in 4.1.14Fixed in 4.2.13Fixed in 4.3.4Fixed in 4.4.1OSV source ↗5 years ago
MediumTYPO3 Open Redirection vulnerability on the backendGHSA-j628-384g-rmgcCVE-2010-3661Affected <4.1.14, >=4.2.0 <4.2.13, >=4.3.0 <4.3.4, >=4.4.0 <4.4.1Fixed in 4.1.14Fixed in 4.2.13Fixed in 4.3.4Fixed in 4.4.1OSV source ↗5 years ago
MediumTYPO3 CMS Allows Broken Access Control in Edit Document ControllerGHSA-5j7q-wmh7-cqhgCVE-2025-59020Affected >=10.0.0 <10.4.55, >=11.0.0 <11.5.49, >=12.0.0 <12.4.41, >=13.0.0 <13.4.23, >=14.0.0 <14.0.2Fixed in 10.4.55Fixed in 11.5.49Fixed in 12.4.41Fixed in 13.4.23Fixed in 14.0.2OSV source ↗10 months ago
MediumTYPO3 CSV download feature information disclosureGHSA-j8vm-7q52-2m2mCVE-2025-59019Affected >=12.0.0 <12.4.37, >=13.0.0 <13.4.18Fixed in 12.4.37Fixed in 13.4.18OSV source ↗last year
MediumTYPO3 Bookmark Toolbar vulnerable to denial of serviceGHSA-xrcq-533q-8rxwCVE-2025-59014Affected >=11.0.0 <12.4.37, >=13.0.0 <13.4.18Fixed in 12.4.37Fixed in 13.4.18OSV source ↗last year
MediumTYPO3 cross-site scripting (XSS) vulnerability in the RemoveXSS function and the backendGHSA-mwqv-jff6-5v62CVE-2010-3715Affected >=4.2.0 <4.2.15, >=4.3.0 <4.3.7, >=4.4.0 <4.4.4Fixed in 4.2.15Fixed in 4.3.7Fixed in 4.4.4OSV source ↗4 years ago
MediumTYPO3 Cross-site Scripting vulnerability in the file backend moduleGHSA-733v-22mg-7f8wCVE-2008-5644Affected >=4.2.2 <4.2.3Fixed in 4.2.3OSV source ↗4 years ago
MediumTYPO3 Backend Discloses Encryption KeyGHSA-2wgg-c8xc-7gg3CVE-2009-3628Affected <=4.0.13, >=4.1.0 <4.1.13, >=4.2.0 <4.2.10, >=4.3alpha1 <4.3beta2Fixed in 4.1.13Fixed in 4.2.10Fixed in 4.3beta2OSV source ↗5 years ago
MediumTYPO3 Backend vulnerable to Frame HijackingGHSA-mg66-3x8x-r8g2CVE-2009-3630Affected <=4.0.13, >=4.1.0 <4.1.13, >=4.2.0 <4.2.10, >=4.3alpha1 <4.3beta2Fixed in 4.1.13Fixed in 4.2.10Fixed in 4.3beta2OSV source ↗5 years ago
MediumTYPO3 Cross-site Scripting vulnerability in the extension manager and backend formsGHSA-jr79-65xr-q7cxCVE-2010-3659Affected >=4.1.0 <4.1.14, >=4.2.0 <4.2.13, >=4.3.0 <4.3.4, >=4.4.0 <4.4.1Fixed in 4.1.14Fixed in 4.2.13Fixed in 4.3.4Fixed in 4.4.1OSV source ↗4 years ago
MediumTYPO3 is vulnerable to Cross-Site Scripting (XSS) on the backendGHSA-cg45-qgcf-hf9xCVE-2010-3660Affected <4.1.14, >=4.2.0 <4.2.13, >=4.3.0 <4.3.4, >=4.4.0 <4.4.1Fixed in 4.1.14Fixed in 4.2.13Fixed in 4.3.4Fixed in 4.4.1OSV source ↗5 years ago
MediumCross-Site Scripting in Content Preview (CType menu)GHSA-x7hc-x7fm-f7qhBIT-typo3-2021-21370CVE-2021-21370Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=7.0.0 <7.6.51, >=8.0.0 <8.7.40, >=9.0.0 <9.5.25Fixed in 10.4.14Fixed in 11.1.1Fixed in 7.6.51Fixed in 8.7.40Fixed in 9.5.25OSV source ↗6 years ago
MediumCross-Site Scripting in Content PreviewGHSA-fjh3-g8gq-9q92BIT-typo3-2021-21340CVE-2021-21340Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1Fixed in 10.4.14Fixed in 11.1.1OSV source ↗6 years ago
LowInformation Disclosure in TYPO3 Page TreeGHSA-rf5m-h8q9-9w6qCVE-2024-47780Affected >=10.0.0 <10.4.46, >=11.0.0 <11.5.40, >=12.0.0 <12.4.21, >=13.0.0 <13.3.1Fixed in 10.4.46Fixed in 11.5.40Fixed in 12.4.21Fixed in 13.3.1OSV source ↗2 years ago
LowTYPO3 Backend vulnerable to Cross-site ScriptingGHSA-g857-p997-wx7wCVE-2009-3629Affected <=4.0.13, >=4.1.0 <4.1.13, >=4.2.0 <4.2.10, >=4.3alpha1 <4.3beta2Fixed in 4.1.13Fixed in 4.2.10Fixed in 4.3beta2OSV source ↗5 years ago
LowDenial of Service in TYPO3 Bookmark ToolbarGHSA-ffcv-v6pw-qhrpCVE-2024-34537Affected >=10.0.0 <10.4.46, >=11.0.0 <11.5.40, >=12.0.0 <12.4.21, >=13.0.0 <13.3.1Fixed in 10.4.46Fixed in 11.5.40Fixed in 12.4.21Fixed in 13.3.1OSV source ↗2 years ago
  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.