TYPO3 TYPO3 CMS
38 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-109162 | 14.0.0 – < 14.3.9 | TYPO3 CMS - Security Misconfiguration in Form Framework | MEDIUM 6.3 | 0.4 % | ||
| CVE-2026-77132 | 10.0.0 – < 10.4.60 ; 11.0.0 – < 11.5.54 ; 12.0.0 – < 12.4.49 ; … | TYPO3 CMS - Information Disclosure via Backend Localization Wizard | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-85400 | 14.2.0 – < 14.3.7 | TYPO3 CMS - Missing Authorization in lowlevel commands | HIGH 7.5 | 0.5 % | ||
| CVE-2026-19418 | 13.0.0 – < 13.4.34 ; 14.0.0 – < 14.3.6 | TYPO3 CMS - Broken Access Control in Backend and Install Tool | HIGH 7.3 | 0.2 % | ||
| CVE-2026-15305 | 14.2.0 – < 14.3.5 | TYPO3 CMS - Unrestricted File Upload in Form Framework | MEDIUM 6.3 | 0.3 % | ||
| CVE-2026-49742 | 11.0.0 – < 11.5.51 ; 12.0.0 – < 12.4.46 ; 13.0.0 – < 13.4.31 ; … | TYPO3 CMS - Broken Access Control in Media Module | HIGH 7.1 | 0.3 % | ||
| CVE-2026-49741 | 14.0.0 – < 14.3.3 | TYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework | HIGH 8.7 | 0.2 % | ||
| CVE-2026-49740 | < 10.4.57 ; 11.0.0 – < 11.5.51 ; 12.0.0 – < 12.4.46 ; … | TYPO3 CMS - Insecure Deserialization in Core API | MEDIUM 6.3 | 0.2 % | ||
| CVE-2026-49738 | < 10.4.57 ; 11.0.0 – < 11.5.51 ; 12.0.0 – < 12.4.46 ; … | TYPO3 CMS - Broken Access Control in File Abstraction Layer | LOW 2.1 | 0.4 % | ||
| CVE-2026-47352 | < 10.4.57 ; 11.0.0 – < 11.5.51 ; 12.0.0 – < 12.4.46 ; … | TYPO3 CMS - Broken Access Control in Backend API | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-47351 | 10.4.0 – < 13.4.31 ; 14.0.0 – < 14.3.3 | TYPO3 CMS - Broken Access Control in Clipboard | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-47350 | 13.0.0 – < 13.4.31 ; 14.0.0 – < 14.3.3 | TYPO3 CMS - Broken Access Control in DataHandler | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-47349 | < 10.4.57 ; 11.0.0 – < 11.5.51 ; 12.0.0 – < 12.4.46 ; … | TYPO3 CMS - Broken Access Control in Recycler | MEDIUM 5.3 | 0.2 % | ||
| CVE-2026-47348 | 13.0.0 – < 13.4.31 ; 14.0.0 – < 14.3.3 | TYPO3 CMS - Cross-Site Scripting in Indexed Search | MEDIUM 5.1 | 0.3 % | ||
| CVE-2026-47347 | < 10.4.57 ; 11.0.0 – < 11.5.51 ; 12.0.0 – < 12.4.46 ; … | TYPO3 CMS - Open Redirect in Core Utilities | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-47346 | < 10.4.57 ; 11.0.0 – < 11.5.51 ; 12.0.0 – < 12.4.46 ; … | TYPO3 CMS - Broken Access Control in Form Framework | HIGH 7.6 | 0.3 % | ||
| CVE-2026-47343 | < 10.4.57 ; 11.0.0 – < 11.5.51 ; 12.0.0 – < 12.4.46 ; … | TYPO3 CMS - Destructive Actions on File Mount Folders | HIGH 7.2 | 0.2 % | ||
| CVE-2026-11607 | < 10.4.57 ; 11.0.0 – < 11.5.51 ; 12.0.0 – < 12.4.46 ; … | TYPO3 CMS - Broken Access Control in Form Framework | HIGH 7.6 | 0.2 % | ||
| CVE-2026-6553 | 14.2.0 – < 14.3.0 | TYPO3 CMS Stores Cleartext Password in User Settings Module | HIGH 7.3 | 0.2 % | ||
| CVE-2026-0859 | 10.0.0 – < 10.4.55 ; 11.0.0 – < 11.5.49 ; 12.0.0 – < 12.4.41 ; … | TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool | MEDIUM 5.2 | 0.2 % | ||
| CVE-2025-59022 | 10.0.0 – < 10.4.55 ; 11.0.0 – < 11.5.49 ; 12.0.0 – < 12.4.41 ; … | TYPO3 CMS Allows Broken Access Control in Recycler Module | HIGH 7.1 | 0.4 % | ||
| CVE-2025-59021 | 10.0.0 – < 10.4.55 ; 11.0.0 – < 11.5.49 ; 12.0.0 – < 12.4.41 ; … | TYPO3 CMS Allows Broken Access Control in Redirects Module | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-59020 | 10.0.0 – < 10.4.55 ; 11.0.0 – < 11.5.49 ; 12.0.0 – < 12.4.41 ; … | TYPO3 CMS Allows Broken Access Control in Edit Document Controller | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-59019 | 12.0.0 – < 12.4.37 ; 13.0.0 – < 13.4.18 | Information Disclosure via CSV Download | MEDIUM 5.3 | 0.2 % | ||
| CVE-2025-59018 | 9.0.0 – < 9.5.55 ; 10.0.0 – < 10.4.54 ; 11.0.0 – < 11.5.48 ; … | Information Disclosure in Workspaces Module | HIGH 7.1 | 0.3 % | ||
| CVE-2025-59017 | 9.0.0 – < 9.5.55 ; 10.0.0 – < 10.4.54 ; 11.0.0 – < 11.5.48 ; … | Broken Access Control in Backend AJAX Routes | MEDIUM 5.3 | 0.3 % | ||
| CVE-2025-59016 | 9.0.0 – < 9.5.55 ; 10.0.0 – < 10.4.54 ; 11.0.0 – < 11.5.48 ; … | Information Disclosure via File Abstraction Layer | MEDIUM 5.3 | 0.2 % | ||
| CVE-2025-59015 | 12.0.0 – < 12.4.37 ; 13.0.0 – < 13.4.18 | Insufficient Entropy in Password Generation | MEDIUM 6.3 | 0.2 % | ||
| CVE-2025-59014 | 11.0.0 – < 11.5.48 ; 12.0.0 – < 12.4.37 ; 13.0.0 – < 13.4.18 | Denial of Service in TYPO3 Bookmark Toolbar | MEDIUM 5.1 | 0.3 % | ||
| CVE-2025-59013 | 9.0.0 – < 9.5.55 ; 10.0.0 – < 10.4.54 ; 11.0.0 – < 11.5.48 ; … | Open Redirect in TYPO3 CMS | MEDIUM 5.3 | 0.2 % | ||
| CVE-2020-15098 | >= 9.0.0, < 9.5.20 ; >= 10.0.0, 10.4.6 | Missing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMS | HIGH 8.8 | 2.2 % | ||
| CVE-2020-15099 | >= 9.0.0, < 9.5.20 ; >= 10.0.0, 10.4.6 | Exposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMS | HIGH 8.1 | 1.8 % | ||
| CVE-2020-11069 | >= 9.0.0, < 9.5.17 ; >= 10.0.0, < 10.4.2 | Cross-Site Request Forgery in TYPO3 CMS | HIGH 8.8 | 0.7 % | ||
| CVE-2020-11067 | >= 9.0.0, < 9.5.17 ; >= 10.0.0, < 10.4.2 | Deserialization of Untrusted Data in TYPO3 CMS | HIGH 8.8 | 2.0 % | ||
| CVE-2020-11066 | >= 9.0.0, < 9.5.17 ; >= 10.0.0, < 10.4.2 | Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS | CRITICAL 10.0 | 1.5 % | ||
| CVE-2020-11065 | >= 9.5.12, < 9.5.17 ; >= 10.2.0, < 10.4.2 | Cross-Site Scripting in TYPO3 CMS | MEDIUM 5.4 | 0.5 % | ||
| CVE-2020-11064 | >= 9.0.0, < 9.5.17 ; >= 10.0.0, < 10.4.2 | Cross-Site Scripting in TYPO3 CMS | MEDIUM 5.4 | 0.5 % | ||
| CVE-2020-11063 | >= 10.4.0, <= 10.4.1 | Observable Response Discrepancy in TYPO3 CMS | LOW 3.7 | 1.2 % |