Typo3

Typo3

222 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
8.8

CVE-2017-14251

Exploit
  • EPSS 2.31%
  • Veröffentlicht 11.09.2017 09:29:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Unrestricted File Upload vulnerability in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php in TYPO3 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4 allows remote authenticated users to upload files with a .pht extension and consequentl...

5.3

CVE-2017-6370

Exploit
  • EPSS 0.99%
  • Veröffentlicht 17.03.2017 17:59:00
  • Zuletzt bearbeitet 13.05.2026 00:24:29

TYPO3 7.6.15 sends an http request to an index.php?loginProvider URI in cases with an https Referer, which allows remote attackers to obtain sensitive cleartext information by sniffing the network and reading the userident and username fields.

6.1

CVE-2016-4056

Exploit
  • EPSS 1.08%
  • Veröffentlicht 23.01.2017 21:59:01
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Cross-site scripting (XSS) vulnerability in the Backend component in TYPO3 6.2.x before 6.2.19 allows remote attackers to inject arbitrary web script or HTML via the module parameter when creating a bookmark.

8.1

CVE-2016-5091

  • EPSS 2.58%
  • Veröffentlicht 23.01.2017 21:59:01
  • Zuletzt bearbeitet 13.05.2026 00:24:29

Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.

6.1

CVE-2015-8760

  • EPSS 1.43%
  • Veröffentlicht 08.01.2016 19:59:26
  • Zuletzt bearbeitet 06.05.2026 22:30:45

The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vectors, aka "Cross-Site Flashing."

5.4

CVE-2015-8759

  • EPSS 0.64%
  • Veröffentlicht 08.01.2016 19:59:25
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authenticated editors to inject arbitrary web script or HTML via a link field.

5.4

CVE-2015-8758

  • EPSS 1.14%
  • Veröffentlicht 08.01.2016 19:59:24
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.

6.1

CVE-2015-8757

  • EPSS 1.43%
  • Veröffentlicht 08.01.2016 19:59:23
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to extension data during an extension i...

5.4

CVE-2015-8756

  • EPSS 0.8%
  • Veröffentlicht 08.01.2016 19:59:22
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed_search) component in TYPO3 6.2.x before 6.2.16 allows remote authenticated editors to inject arbitrary web script or HTML via unspecified vectors.

5.4

CVE-2015-8755

  • EPSS 1.14%
  • Veröffentlicht 08.01.2016 19:59:21
  • Zuletzt bearbeitet 06.05.2026 22:30:45

Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allow remote authenticated editors to inject arbitrary web script or HTML via unknown vectors.