DemoBook a demo

typo3/cms-core 10.4.10 vulnerabilities

128 advisories known · typo3/cms-core@10.4.10 · 58 affect this release · Dependencies not checked · showing first 100

SEVERITYADVISORYPUBLISHED

Affects 10.4.10

SEVERITYADVISORYPUBLISHED
HighTYPO3 is vulnerable to Cross-Site Scripting via frontend renderingGHSA-r4f8-f93x-5qh3BIT-typo3-2023-24814CVE-2023-24814Affected >=10.0.0 <10.4.36, >=11.0.0 <11.5.23, >=12.0.0 <12.2.0, >=8.7.0 <8.7.51, >=9.0.0 <9.5.40Fixed in 10.4.36Fixed in 11.5.23Fixed in 12.2.0Fixed in 8.7.51Fixed in 9.5.40OSV source ↗4 years ago
HighUnrestricted File Upload in Form FrameworkGHSA-2r6j-862c-m2v2BIT-typo3-2021-21355CVE-2021-21355Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14Fixed in 11.1.1Fixed in 9.5.25OSV source ↗6 years ago
HighBroken Access Control in Form FrameworkGHSA-3vg7-jw9m-pc3fBIT-typo3-2021-21357CVE-2021-21357Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14Fixed in 11.1.1Fixed in 9.5.25OSV source ↗6 years ago
HighTYPO3 CMS has Broken Access Control in its Form FrameworkGHSA-pjpj-v387-x4vqCVE-2026-11607Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago
HighTYPO3 CMS: Destructive Actions on File Mount FoldersGHSA-3v8v-4wg6-r7qhCVE-2026-47343Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago
HighTYPO3 CMS has Broken Access Control in its Form FrameworkGHSA-hwvq-2w67-rvxpCVE-2026-47346Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago
HighTYPO3 CMS vulnerable to Arbitrary Code Execution via Form FrameworkGHSA-c5wx-6c2c-f7rmBIT-typo3-2022-23503CVE-2022-23503Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1, >=8.0.0 <8.7.49, >=9.0.0 <9.5.38Fixed in 10.4.33Fixed in 11.5.20Fixed in 12.1.1Fixed in 8.7.49Fixed in 9.5.38OSV source ↗4 years ago
HighTYPO3 Allows Privilege Escalation to System MaintainerGHSA-6frx-j292-c844CVE-2025-47940Affected >=10.4.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12Fixed in 10.4.50Fixed in 11.5.44Fixed in 12.4.31Fixed in 13.4.12OSV source ↗last year
HighTYPO3 Install Tool vulnerable to Code ExecutionGHSA-5w2h-59j3-8x5wCVE-2024-22188Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43Fixed in 11.5.35Fixed in 12.4.11Fixed in 13.0.1Fixed in 8.7.57Fixed in 9.5.46OSV source ↗3 years ago
HighTYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data HandlerGHSA-rj3x-wvc6-5j66CVE-2024-25121Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43Fixed in 11.5.35Fixed in 12.4.11Fixed in 13.0.1Fixed in 8.7.57Fixed in 9.5.46OSV source ↗3 years ago
MediumCross-Site Scripting in Backend Grid ViewGHSA-rgcg-28xm-8mmwBIT-typo3-2021-32669CVE-2021-32669Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=8.0.0 <8.7.41, >=9.0.0 <9.5.28Fixed in 10.4.18Fixed in 11.3.1Fixed in 8.7.41Fixed in 9.5.28OSV source ↗5 years ago
MediumCross-Site Scripting in Query Generator & Query ViewGHSA-6mh3-j5r5-2379BIT-typo3-2021-32668CVE-2021-32668Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=8.0.0 <8.7.41, >=9.0.0 <9.5.28Fixed in 10.4.18Fixed in 11.3.1Fixed in 8.7.41Fixed in 9.5.28OSV source ↗5 years ago
MediumCross-Site Scripting in Page PreviewGHSA-8mq9-fqv8-59wfBIT-typo3-2021-32667CVE-2021-32667Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=9.0.0 <9.5.28Fixed in 10.4.18Fixed in 11.3.1Fixed in 9.5.28OSV source ↗5 years ago
MediumTYPO3 HTML Sanitizer Bypasses Cross-Site Scripting ProtectionGHSA-47m6-46mj-p235CVE-2022-36020Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32Fixed in 11.5.16OSV source ↗4 years ago
MediumTYPO3 HTML Sanitizer Bypasses Cross-Site Scripting ProtectionGHSA-gqqf-g5r7-84vfAffected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16, >=7.0.0 <7.6.58, >=8.0.0 <8.7.48, >=9.0.0 <9.5.37Fixed in 10.4.32Fixed in 11.5.16Fixed in 7.6.58Fixed in 8.7.48Fixed in 9.5.37OSV source ↗4 years ago
MediumCross-Site Scripting via Rich-Text ContentGHSA-c5c9-8c6m-727vBIT-typo3-2021-32768CVE-2021-32768Affected >=10.0.0 <10.4.19, >=11.0.0 <11.3.2, >=7.0.0 <7.6.53, >=8.0.0 <8.7.42, >=9.0.0 <9.5.29Fixed in 10.4.19Fixed in 11.3.2Fixed in 7.6.53Fixed in 8.7.42Fixed in 9.5.29OSV source ↗5 years ago
MediumOpen Redirection in Login HandlingGHSA-4jhw-2p6j-5wmpBIT-typo3-2021-21338CVE-2021-21338Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=6.2.0 <6.2.57, >=7.0.0 <7.6.51, >=8.0.0 <8.7.40, >=9.0.0 <9.5.25Fixed in 10.4.14Fixed in 11.1.1Fixed in 6.2.57Fixed in 7.6.51Fixed in 8.7.40Fixed in 9.5.25OSV source ↗6 years ago
MediumTYPO3 CMS has Broken Access Control in the Recycler ModuleGHSA-f34x-rx2w-7pm3CVE-2026-47349Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago
MediumTYPO3 CMS has an Open Redirect Vulnerability via Core UtilitiesGHSA-3p42-w5ch-gg42CVE-2026-47347Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago
MediumTYPO3 CMS has Insecure Deserialization via Core APIGHSA-c78m-c52x-jgwpCVE-2026-49740Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago
MediumTYPO3 CMS has Broken Access Control in Backend APIGHSA-2j54-93q2-3hjqCVE-2026-47352Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago
MediumTYPO3 CMS: Broken Access Control in Media ModuleGHSA-q93m-25xv-94hhCVE-2026-47351Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago
MediumTYPO3 CMS Allows Insecure Deserialization via Mailer File SpoolGHSA-7vp9-x248-9vr9CVE-2026-0859Affected >=10.0.0 <10.4.55, >=11.0.0 <11.5.49, >=12.0.0 <12.4.41, >=13.0.0 <13.4.23, >=14.0.0 <14.0.2Fixed in 10.4.55Fixed in 11.5.49Fixed in 12.4.41Fixed in 13.4.23Fixed in 14.0.2OSV source ↗10 months ago
MediumTYPO3 CMS exposes sensitive information in an error messageGHSA-cvm2-5f78-g9m8CVE-2025-59016Affected >=13.0.0 <13.4.18, >=9.0.0 <12.4.37Fixed in 12.4.37Fixed in 13.4.18OSV source ↗last year
MediumTYPO3 CMS has an open‐redirect vulnerabilityGHSA-72jf-5fg5-3cw3CVE-2025-59013Affected >=13.0.0 <13.4.18, >=9.0.0 <12.4.37Fixed in 12.4.37Fixed in 13.4.18OSV source ↗last year
MediumInsufficient Session Expiration in TYPO3's Admin ToolGHSA-wwjw-r3gj-39fqBIT-typo3-2022-31050CVE-2022-31050Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=9.0.0 <9.5.35Fixed in 10.4.29Fixed in 11.5.11Fixed in 9.5.35OSV source ↗4 years ago
MediumTYPO3 CMS vulnerable to Weak Authentication in Frontend LoginGHSA-jfp7-79g7-89rfBIT-typo3-2022-23501CVE-2022-23501Affected <8.7.49, >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1, >=9.0.0 <9.5.38Fixed in 10.4.33Fixed in 11.5.20Fixed in 12.1.1Fixed in 8.7.49Fixed in 9.5.38OSV source ↗4 years ago
MediumTYPO3 CMS vulnerable to Denial of Service in Page Error HandlingGHSA-8c28-5mp7-v24hBIT-typo3-2022-23500CVE-2022-23500Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=9.0.0 <9.5.38Fixed in 10.4.33Fixed in 11.5.20Fixed in 9.5.38OSV source ↗4 years ago
MediumDenial of Service in Page Error HandlingGHSA-4p9g-qgx9-397pBIT-typo3-2021-21359CVE-2021-21359Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14Fixed in 11.1.1Fixed in 9.5.25OSV source ↗6 years ago
MediumCleartext storage of session identifierGHSA-qx3w-4864-94chBIT-typo3-2021-21339CVE-2021-21339Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=6.2.0 <6.2.57, >=7.0.0 <7.6.51, >=8.0.0 <8.7.40, >=9.0.0 <9.5.25Fixed in 10.4.14Fixed in 11.1.1Fixed in 6.2.57Fixed in 7.6.51Fixed in 8.7.40Fixed in 9.5.25OSV source ↗6 years ago
MediumTYPO3 CMS vulnerable to Sensitive Information Disclosure via YAML Placeholder Expressions in Site ConfigurationGHSA-8w3p-qh3x-6gjrBIT-typo3-2022-23504CVE-2022-23504Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1, >=9.0.0 <9.5.38Fixed in 10.4.33Fixed in 11.5.20Fixed in 12.1.1Fixed in 9.5.38OSV source ↗4 years ago
MediumPath Traversal in TYPO3 File Abstraction Layer StoragesGHSA-w6x2-jg8h-p6mpBIT-typo3-2023-30451CVE-2023-30451Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43Fixed in 11.5.35Fixed in 12.4.11Fixed in 13.0.1Fixed in 8.7.57Fixed in 9.5.46OSV source ↗3 years ago
MediumTYPO3 Allows Unrestricted File Upload in File Abstraction LayerGHSA-9hq9-cr36-4wpjCVE-2025-47939Affected >=10.0.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12, >=9.0.0 <9.5.51Fixed in 10.4.50Fixed in 11.5.44Fixed in 12.4.31Fixed in 13.4.12Fixed in 9.5.51OSV source ↗last year
MediumTYPO3 vulnerable to Cross-Site Scripting in the ShowImageControllerGHSA-hw6c-6gwq-3m3mCVE-2024-34357Affected >=10.0.0 <10.4.45, >=11.0.0 <11.5.37, >=12.0.0 <12.4.15, >=13.0.0 <13.1.1, >=9.0.0 <9.5.48Fixed in 10.4.45Fixed in 11.5.37Fixed in 12.4.15Fixed in 13.1.1Fixed in 9.5.48OSV source ↗2 years ago
MediumTYPO3 vulnerable to Cross-Site Scripting in the Form Manager ModuleGHSA-v6mw-h7w6-59w3CVE-2024-34356Affected >=10.0.0 <10.4.45, >=11.0.0 <11.5.37, >=12.0.0 <12.4.15, >=13.0.0 <13.1.1, >=9.0.0 <9.5.48Fixed in 10.4.45Fixed in 11.5.37Fixed in 12.4.15Fixed in 13.1.1Fixed in 9.5.48OSV source ↗2 years ago
MediumTYPO3 CMS vulnerable to Insufficient Session Expiration after Password ResetGHSA-mgj2-q8wp-29rrBIT-typo3-2022-23502CVE-2022-23502Affected >=10.0.0 <10.4.33, >=11.0.0 <11.5.20, >=12.0.0 <12.1.1Fixed in 10.4.33Fixed in 11.5.20Fixed in 12.1.1OSV source ↗4 years ago
MediumTYPO3 CMS missing check for expiration time of password reset token for backend usersGHSA-5959-4x58-r8c2BIT-typo3-2022-36106CVE-2022-36106Affected >=10.4.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32Fixed in 11.5.16OSV source ↗4 years ago
MediumTYPO3 CMS Stored Cross-Site Scripting via FileDumpControllerGHSA-9c6w-55cp-5w25BIT-typo3-2022-36107CVE-2022-36107Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16, >=7.0.0 <7.6.58, >=8.0.0 <8.7.48, >=9.0.0 <9.5.37Fixed in 10.4.32Fixed in 11.5.16Fixed in 7.6.58Fixed in 8.7.48Fixed in 9.5.37OSV source ↗4 years ago
MediumTYPO3 CMS vulnerable to Cross-Site Scripting in <f:asset.css> view helperGHSA-fv2m-9249-qx85BIT-typo3-2022-36108CVE-2022-36108Affected >=10.3.0 <10.4.32, >=11.0.0 <11.5.16Fixed in 10.4.32Fixed in 11.5.16OSV source ↗4 years ago
MediumCross-Site Scripting in TYPO3's Frontend Login MailerGHSA-h4mx-xv96-2jgmBIT-typo3-2022-31049CVE-2022-31049Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=9.0.0 <9.5.35Fixed in 10.4.29Fixed in 11.5.11Fixed in 9.5.35OSV source ↗4 years ago
MediumCross-Site Scripting in TYPO3's Form FrameworkGHSA-3r95-23jp-mhvgBIT-typo3-2022-31048CVE-2022-31048Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=8.0.0 <8.7.47, >=9.0.0 <9.5.35Fixed in 10.4.29Fixed in 11.5.11Fixed in 8.7.47Fixed in 9.5.35OSV source ↗4 years ago
MediumCross-Site Scripting in Content Preview (CType menu)GHSA-x7hc-x7fm-f7qhBIT-typo3-2021-21370CVE-2021-21370Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1, >=9.0.0 <9.5.25Fixed in 10.4.14Fixed in 11.1.1Fixed in 9.5.25OSV source ↗6 years ago
MediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-formGHSA-x79j-wgqv-g8h2BIT-typo3-2021-21358CVE-2021-21358Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1Fixed in 10.4.14Fixed in 11.1.1OSV source ↗6 years ago
MediumCross-Site Scripting in Content PreviewGHSA-fjh3-g8gq-9q92BIT-typo3-2021-21340CVE-2021-21340Affected >=10.0.0 <10.4.14, >=11.0.0 <11.1.1Fixed in 10.4.14Fixed in 11.1.1OSV source ↗6 years ago
MediumTYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageControllerGHSA-36g8-62qv-5957CVE-2024-34358Affected >=10.0.0 <10.4.45, >=11.0.0 <11.5.37, >=12.0.0 <12.4.15, >=13.0.0 <13.1.1, >=9.0.0 <9.5.48Fixed in 10.4.45Fixed in 11.5.37Fixed in 12.4.15Fixed in 13.1.1Fixed in 9.5.48OSV source ↗2 years ago
MediumTYPO3 CMS vulnerable to User Enumeration via Response TimingGHSA-m392-235j-9r7rBIT-typo3-2022-36105CVE-2022-36105Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16, >=7.0.0 <7.6.58, >=8.0.0 <8.7.48, >=9.0.0 <9.5.37Fixed in 10.4.32Fixed in 11.5.16Fixed in 7.6.58Fixed in 8.7.48Fixed in 9.5.37OSV source ↗4 years ago
MediumInsertion of Sensitive Information into Log File in typo3/cms-coreGHSA-fh99-4pgr-8j99BIT-typo3-2022-31047CVE-2022-31047Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=7.0.0 <7.6.57, >=8.0.0 <8.7.47, >=9.0.0 <9.5.35Fixed in 10.4.29Fixed in 11.5.11Fixed in 7.6.57Fixed in 8.7.47Fixed in 9.5.35OSV source ↗4 years ago
MediumInformation Disclosure in User AuthenticationGHSA-34fr-fhqr-7235BIT-typo3-2021-32767CVE-2021-32767Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=7.0.0 <7.6.52, >=8.0.0 <8.7.41, >=9.0.0 <9.5.28Fixed in 10.4.18Fixed in 11.3.1Fixed in 7.6.52Fixed in 8.7.41Fixed in 9.5.28OSV source ↗5 years ago
MediumTYPO3 Install Tool vulnerable to Information Disclosure of Encryption KeyGHSA-h47m-3f78-qp9gCVE-2024-25119Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43Fixed in 11.5.35Fixed in 12.4.11Fixed in 13.0.1Fixed in 8.7.57Fixed in 9.5.46OSV source ↗3 years ago
MediumTYPO3 Potential Open Redirect via Parsing DifferencesGHSA-2fx5-pggv-6jjrCVE-2024-55892Affected >=10.0.0 <10.4.48, >=11.0.0 <11.5.42, >=12.0.0 <12.4.25, >=13.0.0 <13.4.3, >=9.0.0 <9.5.49Fixed in 10.4.48Fixed in 11.5.42Fixed in 12.4.25Fixed in 13.4.3Fixed in 9.5.49OSV source ↗2 years ago
MediumTYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI SchemeGHSA-wf85-8hx9-gj7cCVE-2024-25120Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43Fixed in 11.5.35Fixed in 12.4.11Fixed in 13.0.1Fixed in 8.7.57Fixed in 9.5.46OSV source ↗3 years ago
MediumTYPO3 Backend Forms vulnerable to Information Disclosure of Hashed PasswordsGHSA-38r2-5695-334wCVE-2024-25118Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43Fixed in 11.5.35Fixed in 12.4.11Fixed in 13.0.1Fixed in 8.7.57Fixed in 9.5.46OSV source ↗3 years ago
MediumInformation Disclosure via Export ModuleGHSA-8gmv-9hwg-w89gBIT-typo3-2022-31046CVE-2022-31046Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=7.0.0 <7.6.57, >=8.0.0 <8.7.47, >=9.0.0 <9.5.35Fixed in 10.4.29Fixed in 11.5.11Fixed in 7.6.57Fixed in 8.7.47Fixed in 9.5.35OSV source ↗4 years ago
MediumTYPO3 vulnerable to Weak Authentication in Session HandlingGHSA-3vmm-7h4j-69rmBIT-typo3-2023-47127CVE-2023-47127Affected >=10.0.0 <10.4.41, >=11.0.0 <11.5.33, >=12.0.0 <12.4.8, >=8.0.0 <8.7.55, >=9.0.0 <9.5.44Fixed in 10.4.41Fixed in 11.5.33Fixed in 12.4.8Fixed in 8.7.55Fixed in 9.5.44OSV source ↗3 years ago
LowTYPO3 Unverified Password Change for Backend UsersGHSA-3jrg-97f3-rqh9CVE-2025-47938Affected >=10.0.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12, >=9.0.0 <9.5.51Fixed in 10.4.50Fixed in 11.5.44Fixed in 12.4.31Fixed in 13.4.12Fixed in 9.5.51OSV source ↗last year
LowTYPO3 Allows Information Disclosure via DBAL Restriction HandlingGHSA-x8pv-fgxp-8v3xCVE-2025-47937Affected >=10.0.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12, >=9.0.0 <9.5.51Fixed in 10.4.50Fixed in 11.5.44Fixed in 12.4.31Fixed in 13.4.12Fixed in 9.5.51OSV source ↗last year
LowInformation Disclosure due to Out-of-scope Site ResolutionGHSA-jq6g-4v5m-wm9rBIT-typo3-2023-38499CVE-2023-38499Affected >=10.0.0 <10.4.39, >=11.0.0 <11.5.30, >=12.0.0 <12.4.4, >=9.4.0 <9.5.42Fixed in 10.4.39Fixed in 11.5.30Fixed in 12.4.4Fixed in 9.5.42OSV source ↗3 years ago
LowTYPO3 CMS has Broken Access Control in its File Abstraction LayerGHSA-jf56-v8jc-jcc5CVE-2026-49738Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago

Does not affect 10.4.10

SEVERITYADVISORYPUBLISHED
CriticalTYPO3 CMS Insecure Deserialization & Arbitrary Code ExecutionGHSA-cc97-g92w-jm65Affected >=7.0.0 <7.6.30, >=8.0.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 7.6.30Fixed in 8.7.17Fixed in 9.3.2OSV source ↗2 years ago
HighTYPO3 Arbitrary Code Execution and Cross-Site Scripting in Backend APIGHSA-x428-565f-8xj2Affected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27Fixed in 9.5.8OSV source ↗2 years ago
HighTYPO3 Arbitrary Code Execution via File List ModuleGHSA-f9hr-7cfq-mjg2Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23Fixed in 9.5.4OSV source ↗2 years ago
HighTYPO3 Vulnerable to Insecure DeserializationGHSA-86hp-xrhj-fhpqCVE-2019-12747Affected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27Fixed in 9.5.8OSV source ↗4 years ago
HighTYPO3 Insecure Deserialization in Query Generator & Query ViewGHSA-rcgc-4xfc-564vCVE-2019-19849Affected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1Fixed in 8.7.30Fixed in 9.5.12OSV source ↗4 years ago
HighCross-Site-Request-Forgery in BackendGHSA-657m-v5vm-f6rwBIT-typo3-2021-41113CVE-2021-41113Affected >=11.2.0 <11.5.0Fixed in 11.5.0OSV source ↗5 years ago
HighMissing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMSGHSA-m5vr-3m74-jwxpBIT-typo3-2020-15098CVE-2020-15098Affected >=10.0.0 <10.4.6, >=9.0.0 <9.5.20Fixed in 10.4.6Fixed in 9.5.20OSV source ↗6 years ago
HighInsecure Deserialization in Backend User Settings in TYPO3 CMSGHSA-2wj9-434x-9hvpBIT-typo3-2020-11067CVE-2020-11067Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2Fixed in 9.5.17OSV source ↗6 years ago
HighClass destructors causing side-effects when being unserialized in TYPO3 CMSGHSA-2rxh-h6h9-qrqcBIT-typo3-2020-11066CVE-2020-11066Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2Fixed in 9.5.17OSV source ↗6 years ago
HighTYPO3 Security Misconfiguration in Frontend Session HandlingGHSA-82vp-jr39-4j2jAffected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27Fixed in 9.5.8OSV source ↗2 years ago
HighTYPO3 Possible Insecure Deserialization in Extbase Request HandlingGHSA-5h5v-m596-r6rfAffected >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 8.7.30Fixed in 9.5.12OSV source ↗2 years ago
HighCleartext storage of session identifierGHSA-954j-f27r-cj52BIT-typo3-2020-26228CVE-2020-26228Affected >=10.0.0 <10.4.10, >=8.7.0 <8.7.38, >=9.0.0 <9.5.23Fixed in 10.4.10Fixed in 8.7.38Fixed in 9.5.23OSV source ↗6 years ago
HighExposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMSGHSA-3x94-fv5h-5q2cBIT-typo3-2020-15099CVE-2020-15099Affected >=10.0.0 <10.4.6, >=9.0.0 <9.5.20Fixed in 10.4.6Fixed in 9.5.20OSV source ↗6 years ago
HighTYPO3 CMS - Broken Access Control in Backend and Install ToolGHSA-68jx-f42c-7599CVE-2026-19418Affected >=14.0.0 <14.3.6Fixed in 14.3.6OSV source ↗2 months ago
HighTYPO3 CMS has Privilege Escalation & SQL Injection in its Form FrameworkGHSA-jh32-v29g-68pqCVE-2026-49741Affected >=14.0.0 <14.3.3Fixed in 14.3.3OSV source ↗5 months ago
HighTYPO3 CMS has Broken Access Control in its Media ModuleGHSA-chm7-4vch-h8vrCVE-2026-49742Affected >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 11.5.51Fixed in 12.4.46Fixed in 13.4.31Fixed in 14.3.3OSV source ↗5 months ago
HighBackend Same-Site Request Forgery in TYPO3 CMSGHSA-pqg8-crx9-g8m4BIT-typo3-2020-11069CVE-2020-11069Affected >=10.0.0 <10.4.2, >=9.0.0 <9.5.17Fixed in 10.4.2Fixed in 9.5.17OSV source ↗6 years ago
HighTYPO3 Security Misconfiguration for Backend User AccountsGHSA-rxc9-f2x6-qh4wAffected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23Fixed in 9.5.4OSV source ↗2 years ago
HighTYPO3 Denial of Service in Frontend Record RegistrationGHSA-hjx5-v9xg-7h25Affected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21Fixed in 7.6.32Fixed in 8.7.21OSV source ↗2 years ago
HighTYPO3 Security Misconfiguration in Install Tool CookieGHSA-ppvg-hw62-6ph9Affected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32Fixed in 8.7.21Fixed in 9.5.2OSV source ↗2 years ago
HighTYPO3 CMS Insecure DeserializationGHSA-96jg-pmc4-cx39Affected >=8.5.0 <8.7.17, >=9.0.0 <9.3.1Fixed in 8.7.17Fixed in 9.3.1OSV source ↗2 years ago
HighTYPO3 CMS Privilege Escalation and SQL InjectionGHSA-45wj-jv2h-jwrfAffected >=8.5.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 8.7.17Fixed in 9.3.2OSV source ↗2 years ago
HighTYPO3 CMS Authentication Bypass vulnerabilityGHSA-x4rj-f7m6-42c3Affected >=7.0.0 <7.6.30, >=8.0.0 <8.7.17, >=9.0.0 <9.3.2Fixed in 7.6.30Fixed in 8.7.17Fixed in 9.3.2OSV source ↗2 years ago
HighTYPO3 Image Processing susceptible to Code ExecutionGHSA-3w4h-r27h-4r2wCVE-2019-11832Affected >=8.0.0 <8.7.25, >=9.0.0 <9.5.6Fixed in 8.7.25Fixed in 9.5.6OSV source ↗4 years ago
HighTYPO3 SQL injection vulnerability in the Extbase FrameworkGHSA-m64j-j252-jxmrCVE-2013-1842Affected >=4.5.0 <4.5.24, >=4.6.0 <4.6.17, >=4.7.0 <4.7.9, >=6.0.0 <6.0.3Fixed in 4.5.24Fixed in 4.6.17Fixed in 4.7.9Fixed in 6.0.3OSV source ↗4 years ago
HighDeserialization of untrusted data in SymfonyGHSA-w2fr-65vp-mxw3CVE-2019-10912Affected >=9.0.0 <9.5.8Fixed in 9.5.8OSV source ↗7 years ago
MediumTYPO3 Directory Traversal on ZIP extractionGHSA-77p4-wfr8-977wCVE-2019-19848Affected >=10.0.0 <10.2.2, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.2Fixed in 8.7.30Fixed in 9.5.12OSV source ↗4 years ago
MediumTYPO3 CMS uses insufficient entropy when generating passwordsGHSA-p5jq-5383-qvc7CVE-2025-59015Affected >=12.0.0 <12.4.37, >=13.0.0 <13.4.18Fixed in 12.4.37Fixed in 13.4.18OSV source ↗last year
MediumTYPO3 Security Misconfiguration in User Session HandlingGHSA-xmgr-jff3-fcfvAffected >=8.0.0 <8.7.25, >=9.0.0 <9.5.6Fixed in 8.7.25Fixed in 9.5.6OSV source ↗2 years ago
MediumTYPO3 Broken Access Control in Localization HandlingGHSA-9rx9-7fmh-gj3gAffected >=8.0.0 <8.7.23Fixed in 8.7.23OSV source ↗2 years ago
MediumTYPO3 Cross-Site Scripting in Filelist ModuleGHSA-6xwf-7rfm-4gwcAffected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1Fixed in 8.7.30Fixed in 9.5.12OSV source ↗2 years ago
MediumTYPO3 Cross-Site Scripting in Link HandlingGHSA-4ppr-jw47-9qm5Affected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1Fixed in 8.7.30Fixed in 9.5.12OSV source ↗2 years ago
MediumTYPO3 Cross-Site Scripting in Form Framework validation handlingGHSA-95qm-3xp7-vfj5Affected >=10.0.0 <10.2.1, >=8.0.0 <8.7.30, >=9.0.0 <9.5.12Fixed in 10.2.1Fixed in 8.7.30Fixed in 9.5.12OSV source ↗2 years ago
MediumTYPO3 Cross-Site Scripting in Form FrameworkGHSA-4459-qrcc-vfcfAffected >=8.5.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23Fixed in 9.5.4OSV source ↗2 years ago
MediumTYPO3 Cross-Site Scripting in Language Pack HandlingGHSA-76r3-m635-p3vcAffected >=9.2.0 <9.5.4Fixed in 9.5.4OSV source ↗2 years ago
MediumTYPO3 Cross-Site Scripting in Frontend User LoginGHSA-8c25-vj2w-p72jAffected >=7.1.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32Fixed in 8.7.21Fixed in 9.5.2OSV source ↗2 years ago
MediumTYPO3 Cross-Site Scripting in Backend Modal ComponentGHSA-g4c9-qfvw-fmr4Affected >=7.1.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32Fixed in 8.7.21Fixed in 9.5.2OSV source ↗2 years ago
MediumTYPO3 Cross-Site Scripting in Online Media Asset RenderingGHSA-wg8h-gxf4-g4ghAffected >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 8.7.21Fixed in 9.5.2OSV source ↗2 years ago
MediumTypo3 Cross-Site Scripting in Link HandlingGHSA-r6fv-56gp-j3r4CVE-2019-12748Affected >=8.0.0 <8.7.27, >=9.0.0 <9.5.8Fixed in 8.7.27Fixed in 9.5.8OSV source ↗4 years ago
MediumCross-Site Scripting in Fluid view helpersGHSA-vqqx-jw6p-q3rfBIT-typo3-2020-26227CVE-2020-26227Affected >=10.0.0 <10.4.10, >=8.7.0 <8.7.38, >=9.0.0 <9.5.23Fixed in 10.4.10Fixed in 8.7.38Fixed in 9.5.23OSV source ↗6 years ago
MediumCkeditor XSS VulnerabilityGHSA-g68x-vvqq-pvw3CVE-2018-17960Affected >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 8.7.21Fixed in 9.5.2OSV source ↗8 years ago
MediumBootstrap Cross-site Scripting vulnerabilityGHSA-pj7m-g53m-7638CVE-2018-14041Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23Fixed in 9.5.4OSV source ↗8 years ago
  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.