Typesetter
Approved changes feed: RSS · Atom
cpe:2.3:a:typesettercms:typesetter:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Typesettercms (373a09b5-5ec7-583b-912c-5ba52e97a6b1) |
|---|---|
| Product | Typesetter (c658df85-d232-58f0-9327-bb763e3ff092) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/typesetter/typesetter |
purl2cpe | 2026-06-01 10:13:24.852875 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-71166 |
vulnerable | 2026-06-08 07:43:17.686841 |
Typesetter CMS Reflected XSS via Move Message Handling
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected into the HTML output without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.
Published: 2026-01-14T18:28:40.633Z
Updated: 2026-07-14T22:26:05.329Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-71165 |
vulnerable | 2026-06-08 07:43:17.686335 |
Typesetter CMS Reflected XSS via Status.php
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into the HTML response without proper output encoding in include/admin/Tools/Status.php. An authenticated attacker can supply crafted input containing HTML or JavaScript, resulting in arbitrary script execution in the context of an authenticated user's browser session.
Published: 2026-01-14T18:28:21.375Z
Updated: 2026-07-14T22:26:04.649Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-71164 |
vulnerable | 2026-06-08 07:43:17.685756 |
Typesetter CMS Reflected XSS via Editing.php
Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (submitted as images[] in a POST request) is reflected into an HTML href attribute without proper context-aware output encoding in include/tool/Editing.php. An authenticated attacker with editing privileges can supply a JavaScript pseudo-protocol (e.g., javascript:) to trigger arbitrary JavaScript execution in the context of the victim's browser session.
Published: 2026-01-14T18:27:45.418Z
Updated: 2026-07-14T22:26:03.984Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-35126 |
vulnerable | 2026-06-08 05:25:00.836281 |
Details available
Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report is disputed because "admins are considered trustworthy.
Published: 2020-12-11T03:57:08.000Z
Updated: 2024-08-04T16:55:10.712Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-25790 |
vulnerable | 2026-06-08 05:23:49.447886 |
Details available
Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered trustworthy"; however, the behavior "contradicts our security policy" and is being fixed for 5.2
Published: 2020-09-19T20:31:08.000Z
Updated: 2024-08-04T15:40:36.963Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.