GCVE - cpe:2.3:a:typo3:typo3:*:*:*:*:elts:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:typo3:typo3:*:*:*:*:elts:*:*:*

part: a version: * update: *

Vendor	Typo3 (`bebcd01c-0947-5641-89ed-9b814cca944e`)
Product	Typo3 (`e0e75c36-ce92-5448-bdce-8b59acd8c849`)
Edition	*
Language	*
Software edition	elts
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/typo3/typo3`	purl2cpe	2026-06-01 10:16:08.767876
`pkg:typo3/typo3.cms.git`	purl2cpe	2026-06-01 10:16:08.767878

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-47127`	vulnerable	2026-06-08 06:14:24.024950	Weak Authentication in Session Handling in typo3/cms-core MEDIUM (4.2) TYPO3 is an open source PHP based web content management system released under the GNU GPL. In typo3 installations there are always at least two different sites. Eg. first.example.org and second.example.com. In affected versions a session cookie generated for the first site can be reused on the second site without requiring additional authentication. This vulnerability has been addressed in versions 8.7.55, 9.5.44, 10.4.41, 11.5.33, and 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability. Published: 2023-11-14T19:26:07.849Z Updated: 2024-08-29T20:42:22.685Z Open on db.gcve.eu Reference links https://github.com/TYPO3/typo3/security/advisories/GHSA-3vmm-7h4j-69rm https://github.com/TYPO3/typo3/commit/535dfbdc54fd5362e0bc08d911db44eac7f64019 https://typo3.org/security/advisory/typo3-core-sa-2023-006	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-47125`	vulnerable	2026-06-08 06:14:24.022878	By-passing Cross-Site Scripting Protection in HTML Sanitizer MEDIUM (4.7) TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions DOM processing instructions are not handled correctly. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. This vulnerability has been addressed in versions 1.5.3 and 2.1.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. Published: 2023-11-14T20:07:56.433Z Updated: 2024-08-29T20:25:31.869Z Open on db.gcve.eu Reference links https://github.com/TYPO3/html-sanitizer/security/advisories/GHSA-mm79-jhqm-9j54 https://github.com/TYPO3/html-sanitizer/commit/b8f90717251d968c49dc77f8c1e5912e2fbe0dff https://typo3.org/security/advisory/typo3-core-sa-2023-007	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-31050`	vulnerable	2026-06-08 05:43:40.061244	Insufficient Session Expiration in TYPO3 Admin Tool MEDIUM (6) TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, Admin Tool sessions initiated via the TYPO3 backend user interface had not been revoked even if the corresponding user account was degraded to lower permissions or disabled completely. This way, sessions in the admin tool theoretically could have been prolonged without any limit. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. Published: 2022-06-14T20:55:11.000Z Updated: 2025-04-23T18:15:18.241Z Open on db.gcve.eu Reference links https://github.com/TYPO3/typo3/security/advisories/GHSA-wwjw-r3gj-39fq https://github.com/TYPO3/typo3/commit/592387972912290c135ebecc91768a67f83a3a4d https://typo3.org/security/advisory/typo3-core-sa-2022-005	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-31049`	vulnerable	2026-06-08 05:43:40.060611	Cross-Site Scripting in Frontend Login Mailer MEDIUM (5.4) TYPO3 is an open source web content management system. Prior to versions 9.5.34 ELTS, 10.4.29, and 11.5.11, user submitted content was used without being properly encoded in HTML emails sent to users. The actually affected components were mail clients used to view those messages. TYPO3 versions 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. Published: 2022-06-14T20:50:12.000Z Updated: 2025-04-23T18:15:37.089Z Open on db.gcve.eu Reference links https://github.com/TYPO3/typo3/security/advisories/GHSA-h4mx-xv96-2jgm https://github.com/TYPO3/typo3/commit/da611775f92102d7602713003f4c79606c8a445d https://typo3.org/security/advisory/typo3-core-sa-2022-004	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-31048`	vulnerable	2026-06-08 05:43:40.060088	Cross-Site Scripting in Form Framework MEDIUM (5.4) TYPO3 is an open source web content management system. Prior to versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the Form Designer backend module of the Form Framework is vulnerable to cross-site scripting. A valid backend user account with access to the form module is needed to exploit this vulnerability. TYPO3 versions 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11 contain a fix for the problem. Published: 2022-06-14T20:50:18.000Z Updated: 2025-04-23T18:15:28.239Z Open on db.gcve.eu Reference links https://github.com/TYPO3/typo3/security/advisories/GHSA-3r95-23jp-mhvg https://github.com/TYPO3/typo3/commit/6f2554dc4ea0b670fd5599c54fd788d4db96c4a0 https://typo3.org/security/advisory/typo3-core-sa-2022-003	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-31047`	vulnerable	2026-06-08 05:43:40.059556	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-31046`	vulnerable	2026-06-08 05:43:40.058821	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-32768`	vulnerable	2026-06-08 05:32:07.997020	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2020-8091`	vulnerable	2026-06-08 05:27:14.794920	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.