CVE-2026-47348: fallo de gravedad media en TYPO3 CMS
TYPO3 CMS - Cross-Site Scripting in Indexed Search
Publicada el · Actualizada el
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.1epss 0.5%
probabilidad de explotación
0.5%top 61% de las CVE
explotación observada
noninguna fuente lo reporta
Editors with access to create or modify page content were able to include HTML markup in page titles that were stored in the search index without sanitization. When displayed in frontend search results via the Indexed Search plugin, these titles were rendered without proper output encoding, resulting in a Cross-Site Scripting vulnerability. This issue affects TYPO3 CMS versions 13.0.0-13.4.30 and 14.0.0-14.3.2.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N
Productos afectados
TYPO3 · TYPO3 CMSCVEs relacionadas — TYPO3 CMS
En el mismo producto, de las más peligrosas a las menos.
CVE-2020-15098HIGHMissing Required Cryptographic Step Leading to Sensitive Information Disclosure in TYPO3 CMSEPSS 2.2%CVE-2020-11067HIGHDeserialization of Untrusted Data in TYPO3 CMSEPSS 2.0%CVE-2020-15099HIGHExposure of Sensitive Information to an Unauthorized Actor in TYPO3 CMSEPSS 1.8%CVE-2020-11066HIGHImproperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMSEPSS 1.5%CVE-2020-11063LOWObservable Response Discrepancy in TYPO3 CMSEPSS 1.2%CVE-2020-11069HIGHCross-Site Request Forgery in TYPO3 CMSEPSS 0.7%