Approved changes feed: RSS · Atom
cpe:2.3:a:typo3:typo3.cms:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Typo3 (bebcd01c-0947-5641-89ed-9b814cca944e) |
|---|---|
| Product | Typo3.Cms (cec142c4-0428-5810-be19-0826a9bec0ca) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-32768 |
vulnerable | 2026-06-08 05:32:07.995297 |
Cross-Site Scripting via Rich-Text Content
MEDIUM (6.1)
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions failing to properly parse, sanitize and encode malicious rich-text content, the content rendering process in the website frontend is vulnerable to cross-site scripting. Corresponding rendering instructions via TypoScript functionality HTMLparser does not consider all potentially malicious HTML tag & attribute combinations per default. In default scenarios, a valid backend user account is needed to exploit this vulnerability. In case custom plugins used in the website frontend accept and reflect rich-text content submitted by users, no authentication is required. Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, 11.3.2 that fix the problem described.
Published: 2021-08-10T16:30:11.000Z
Updated: 2024-08-03T23:33:55.826Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32767 |
vulnerable | 2026-06-08 05:32:07.994797 |
Information Disclosure in User Authentication
MEDIUM (5.3)
TYPO3 is an open source PHP based web content management system. In versions 9.0.0 through 9.5.27, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0, user credentials may been logged as plain-text. This occurs when explicitly using log level debug, which is not the default configuration. TYPO3 versions 9.5.28, 10.4.18, 11.3.1 contain a patch for this vulnerability.
Published: 2021-07-20T16:00:11.000Z
Updated: 2024-08-03T23:33:55.829Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32669 |
vulnerable | 2026-06-08 05:32:07.800659 |
Cross-Site Scripting in Backend Grid View
MEDIUM (6.4)
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for _backend layouts_ are not properly encoded, the corresponding grid view is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this vulnerability.
Published: 2021-07-20T15:35:11.000Z
Updated: 2024-08-03T23:25:31.073Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32668 |
vulnerable | 2026-06-08 05:32:07.800130 |
Cross-Site Scripting in Query Generator & Query View
MEDIUM (6.4)
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
Published: 2021-07-20T14:45:13.000Z
Updated: 2024-08-03T23:25:31.124Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-32667 |
vulnerable | 2026-06-08 05:32:07.798968 |
Cross-Site Scripting in Page Preview
MEDIUM (6.4)
TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When _Page TSconfig_ settings are not properly encoded, corresponding page preview module (_Web>View_) is vulnerable to persistent cross-site scripting. A valid backend user account is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.
Published: 2021-07-20T14:40:11.000Z
Updated: 2024-08-03T23:25:31.059Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21370 |
vulnerable | 2026-06-08 05:29:11.766003 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21359 |
vulnerable | 2026-06-08 05:29:11.747135 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21358 |
vulnerable | 2026-06-08 05:29:11.746744 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21357 |
vulnerable | 2026-06-08 05:29:11.746374 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21355 |
vulnerable | 2026-06-08 05:29:11.745906 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21340 |
vulnerable | 2026-06-08 05:29:11.645090 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21339 |
vulnerable | 2026-06-08 05:29:11.644689 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21338 |
vulnerable | 2026-06-08 05:29:11.643303 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-26229 |
vulnerable | 2026-06-08 05:23:50.912545 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-26228 |
vulnerable | 2026-06-08 05:23:50.912010 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-26227 |
vulnerable | 2026-06-08 05:23:50.910727 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.