.nav-burger { display: none !important; } @media (max-width: 1180px) { /* Match Tailwind's base layer: its important [hidden] reset otherwise wins. */ @layer base { .nav-overlay[hidden] { display: flex !important; } } .nav-overlay[hidden] { position: static; padding: 2rem 1rem; } }

typo3/cms-core vulnerabilities

128 known advisories · Dependencies not checked · showing 28 more

SEVERITYADVISORYPUBLISHED

MediumTYPO3 Information Disclosure in User AuthenticationGHSA-wj85-rg5g-v8jmAffected >=9.0.0 <9.5.6Fixed in 9.5.6OSV source ↗2 years ago

MediumTYPO3 Disclosure of Information about Installed ExtensionsGHSA-p2h4-7fp3-cmh8Affected >=8.0.0 <8.7.23, >=9.0.0 <9.5.4Fixed in 8.7.23 Fixed in 9.5.4OSV source ↗2 years ago

MediumTYPO3 Denial of Service in Online Media Asset HandlingGHSA-29m4-mx89-3mjgAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 Information Disclosure in Install ToolGHSA-66c2-7g4p-wx4pAffected >=7.0.0 <7.6.32, >=8.0.0 <8.7.21, >=9.0.0 <9.5.2Fixed in 7.6.32 Fixed in 8.7.21 Fixed in 9.5.2OSV source ↗2 years ago

MediumTYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageControllerGHSA-36g8-62qv-5957CVE-2024-34358Affected >=10.0.0 <10.4.45, >=11.0.0 <11.5.37, >=12.0.0 <12.4.15, >=13.0.0 <13.1.1, >=9.0.0 <9.5.48Fixed in 10.4.45 Fixed in 11.5.37 Fixed in 12.4.15 Fixed in 13.1.1 Fixed in 9.5.48OSV source ↗2 years ago

MediumTYPO3 CMS vulnerable to User Enumeration via Response TimingGHSA-m392-235j-9r7rBIT-typo3-2022-36105CVE-2022-36105Affected >=10.0.0 <10.4.32, >=11.0.0 <11.5.16, >=7.0.0 <7.6.58, >=8.0.0 <8.7.48, >=9.0.0 <9.5.37Fixed in 10.4.32 Fixed in 11.5.16 Fixed in 7.6.58 Fixed in 8.7.48 Fixed in 9.5.37OSV source ↗4 years ago

MediumInsertion of Sensitive Information into Log File in typo3/cms-coreGHSA-fh99-4pgr-8j99BIT-typo3-2022-31047CVE-2022-31047Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=7.0.0 <7.6.57, >=8.0.0 <8.7.47, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 7.6.57 Fixed in 8.7.47 Fixed in 9.5.35OSV source ↗4 years ago

MediumTYPO3 Open redirect vulnerability in the Access tracking mechanism GHSA-7gxq-5qqc-v3fcCVE-2013-1843Affected >=4.5.0 <4.5.24, >=4.6.0 <4.6.17, >=4.7.0 <4.7.9, >=6.0.0 <6.0.3Fixed in 4.5.24 Fixed in 4.6.17 Fixed in 4.7.9 Fixed in 6.0.3OSV source ↗4 years ago

MediumTYPO3 is vulnerable to Information Disclosure in the HTML mailing APIGHSA-5f2f-hr23-j59jCVE-2010-3673Affected <4.2.13, >=4.3 <4.3.4, >=4.4 <4.4.1Fixed in 4.2.13 Fixed in 4.3.4 Fixed in 4.4.1OSV source ↗5 years ago

MediumInformation Disclosure in User AuthenticationGHSA-34fr-fhqr-7235BIT-typo3-2021-32767CVE-2021-32767Affected >=10.0.0 <10.4.18, >=11.0.0 <11.3.1, >=7.0.0 <7.6.52, >=8.0.0 <8.7.41, >=9.0.0 <9.5.28Fixed in 10.4.18 Fixed in 11.3.1 Fixed in 7.6.52 Fixed in 8.7.41 Fixed in 9.5.28OSV source ↗5 years ago

MediumTYPO3 Install Tool vulnerable to Information Disclosure of Encryption KeyGHSA-h47m-3f78-qp9gCVE-2024-25119Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43 Fixed in 11.5.35 Fixed in 12.4.11 Fixed in 13.0.1 Fixed in 8.7.57 Fixed in 9.5.46OSV source ↗3 years ago

MediumTYPO3 Potential Open Redirect via Parsing DifferencesGHSA-2fx5-pggv-6jjrCVE-2024-55892Affected >=10.0.0 <10.4.48, >=11.0.0 <11.5.42, >=12.0.0 <12.4.25, >=13.0.0 <13.4.3, >=9.0.0 <9.5.49Fixed in 10.4.48 Fixed in 11.5.42 Fixed in 12.4.25 Fixed in 13.4.3 Fixed in 9.5.49OSV source ↗2 years ago

MediumHTTP Host Header InjectionGHSA-m2jh-fxw4-gphmBIT-typo3-2021-41114CVE-2021-41114Affected >=11.0.0 <11.5.0Fixed in 11.5.0OSV source ↗5 years ago

MediumCross-Site Scripting in ternary conditional operatorGHSA-7733-hjv6-4h47BIT-typo3-2020-15241CVE-2020-15241Affected >=8.0.0 <8.7.25, >=9.0.0 <9.5.6Fixed in 8.7.25 Fixed in 9.5.6OSV source ↗6 years ago

MediumTYPO3 Broken Access Control in Import ModuleGHSA-g776-759r-pf6xAffected >=9.3.0 <9.5.8Fixed in 9.5.8OSV source ↗2 years ago

MediumTYPO3 Information Disclosure in Page TreeGHSA-wvvp-jwf5-qcpcAffected >=9.0.0 <9.5.6Fixed in 9.5.6OSV source ↗2 years ago

MediumTYPO3 vulnerable to Improper Access Control of Resources Referenced by t3:// URI SchemeGHSA-wf85-8hx9-gj7cCVE-2024-25120Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43 Fixed in 11.5.35 Fixed in 12.4.11 Fixed in 13.0.1 Fixed in 8.7.57 Fixed in 9.5.46OSV source ↗3 years ago

MediumTYPO3 Backend Forms vulnerable to Information Disclosure of Hashed PasswordsGHSA-38r2-5695-334wCVE-2024-25118Affected >=10.0.0 <10.4.43, >=11.0.0 <11.5.35, >=12.0.0 <12.4.11, >=13.0.0 <13.0.1, >=8.0.0 <8.7.57, >=9.0.0 <9.5.46Fixed in 10.4.43 Fixed in 11.5.35 Fixed in 12.4.11 Fixed in 13.0.1 Fixed in 8.7.57 Fixed in 9.5.46OSV source ↗3 years ago

MediumInformation Disclosure via Export ModuleGHSA-8gmv-9hwg-w89gBIT-typo3-2022-31046CVE-2022-31046Affected >=10.0.0 <10.4.29, >=11.0.0 <11.5.11, >=7.0.0 <7.6.57, >=8.0.0 <8.7.47, >=9.0.0 <9.5.35Fixed in 10.4.29 Fixed in 11.5.11 Fixed in 7.6.57 Fixed in 8.7.47 Fixed in 9.5.35OSV source ↗4 years ago

MediumTYPO3 vulnerable to Weak Authentication in Session HandlingGHSA-3vmm-7h4j-69rmBIT-typo3-2023-47127CVE-2023-47127Affected >=10.0.0 <10.4.41, >=11.0.0 <11.5.33, >=12.0.0 <12.4.8, >=8.0.0 <8.7.55, >=9.0.0 <9.5.44Fixed in 10.4.41 Fixed in 11.5.33 Fixed in 12.4.8 Fixed in 8.7.55 Fixed in 9.5.44OSV source ↗3 years ago

LowTYPO3 Unverified Password Change for Backend UsersGHSA-3jrg-97f3-rqh9CVE-2025-47938Affected >=10.0.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12, >=9.0.0 <9.5.51Fixed in 10.4.50 Fixed in 11.5.44 Fixed in 12.4.31 Fixed in 13.4.12 Fixed in 9.5.51OSV source ↗last year

LowTYPO3 Allows Information Disclosure via DBAL Restriction HandlingGHSA-x8pv-fgxp-8v3xCVE-2025-47937Affected >=10.0.0 <10.4.50, >=11.0.0 <11.5.44, >=12.0.0 <12.4.31, >=13.0.0 <13.4.12, >=9.0.0 <9.5.51Fixed in 10.4.50 Fixed in 11.5.44 Fixed in 12.4.31 Fixed in 13.4.12 Fixed in 9.5.51OSV source ↗last year

LowInformation Disclosure due to Out-of-scope Site ResolutionGHSA-jq6g-4v5m-wm9rBIT-typo3-2023-38499CVE-2023-38499Affected >=10.0.0 <10.4.39, >=11.0.0 <11.5.30, >=12.0.0 <12.4.4, >=9.4.0 <9.5.42Fixed in 10.4.39 Fixed in 11.5.30 Fixed in 12.4.4 Fixed in 9.5.42OSV source ↗3 years ago

LowXML External Entity in Dashboard WidgetGHSA-q9cp-mc96-m4w2BIT-typo3-2020-26229CVE-2020-26229Affected >=10.0.0 <10.4.10Fixed in 10.4.10OSV source ↗6 years ago

LowInformation Disclosure in Password ResetGHSA-347x-877p-hcwxBIT-typo3-2020-11063CVE-2020-11063Affected >=10.0.0 <10.4.2Fixed in 10.4.2OSV source ↗6 years ago

LowTYPO3 vulnerable to an HTML Injection in the History ModuleGHSA-xjwx-78x7-q6jcCVE-2024-34355Affected >=13.0.0 <13.1.1Fixed in 13.1.1OSV source ↗2 years ago

LowTYPO3 CMS has Broken Access Control in its File Abstraction LayerGHSA-jf56-v8jc-jcc5CVE-2026-49738Affected <10.4.57, >=11.0.0 <11.5.51, >=12.0.0 <12.4.46, >=13.0.0 <13.4.31, >=14.0.0 <14.3.3Fixed in 10.4.57 Fixed in 11.5.51 Fixed in 12.4.46 Fixed in 13.4.31 Fixed in 14.3.3OSV source ↗5 months ago

LowTYPO3 Cross-site scripting (XSS) vulnerability in the Extbase FrameworkGHSA-qj69-chjp-g4f5CVE-2013-7078Affected >=4.5.0 <4.5.31, >=4.7.0 <4.7.16, >=6.0.0 <6.0.11, >=6.1.0 <6.1.6Fixed in 4.5.31 Fixed in 4.7.16 Fixed in 6.0.11 Fixed in 6.1.6OSV source ↗4 years ago