GCVE - cpe:2.3:a:in2code:femanager:*:*:*:*:*:typo3:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:in2code:femanager:*:*:*:*:*:typo3:*:*

part: a version: * update: *

Vendor	In2Code (`bc03efe5-d384-592e-a988-493ac52bd9ee`)
Product	Femanager (`498e6e47-5dc9-5628-8762-44e98dc8a186`)
Edition	*
Language	*
Software edition	*
Target software	typo3
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2023-25014`	vulnerable	2026-06-08 05:56:08.362517	Details available HIGH (8.6) An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to delete all frontend users. Published: 2023-02-02T00:00:00.000Z Updated: 2025-03-26T17:37:06.843Z Open on db.gcve.eu Reference links https://typo3.org/help/security-advisories https://typo3.org/security/advisory/typo3-ext-sa-2023-001	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2023-25013`	vulnerable	2026-06-08 05:56:08.361931	Details available HIGH (8.6) An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users. Published: 2023-02-02T00:00:00.000Z Updated: 2025-03-26T17:41:06.402Z Open on db.gcve.eu Reference links https://typo3.org/help/security-advisories https://typo3.org/security/advisory/typo3-ext-sa-2023-001	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2022-44543`	vulnerable	2026-06-08 05:49:35.596719	Details available The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the registration form). This occurs because the usergroup.inList protection mechanism is mishandled. Published: 2023-12-12T00:00:00.000Z Updated: 2024-08-03T13:54:03.938Z Open on db.gcve.eu Reference links https://typo3.org/help/security-advisories https://typo3.org/security/advisory/typo3-ext-sa-2022-015	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2021-36787`	vulnerable	2026-06-08 05:32:52.524697	Details available The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document. Published: 2021-08-13T16:15:25.000Z Updated: 2024-08-04T01:01:59.805Z Open on db.gcve.eu Reference links https://typo3.org/help/security-advisories/security https://typo3.org/security/advisory/typo3-ext-sa-2021-010 http://seclists.org/fulldisclosure/2022/Jan/53 http://packetstormsecurity.com/files/165675/TYPO3-femanager-6.3.0-Cross-Site-Scripting.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-6292`	vulnerable	2026-06-08 05:05:57.339373	Details available The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors. Published: 2014-10-03T14:00:00.000Z Updated: 2024-08-06T12:10:13.275Z Open on db.gcve.eu Reference links http://typo3.org/extensions/repository/view/femanager http://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2014-002/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.