Vulnerabilidades em TYPO3

198 resultados
Análise Vexday

O ecossistema de vulnerabilidades do TYPO3 acumula 141 CVEs catalogadas, com 24 registros surgidos nos últimos 90 dias, o que indica um ritmo contínuo de descobertas que merece acompanhamento. Nenhuma das vulnerabilidades está listada no catálogo CISA KEV e não há PoCs públicas conhecidas, colocando a taxa de exploração ativa abaixo da média geral do catálogo — um indicador favorável, mas não suficiente para reduzir a vigilância. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que exige atenção especial em implementações que aceitam entrada de usuários sem sanitização adequada. A CVE mais perigosa atualmente rastreada é CVE-2026-46725, com score EPSS de 0,0231, sugerindo probabilidade de exploração ainda baixa, mas que deve ser monitorada dado o contexto das 2 vulnerabilidades de severidade crítica presentes no portfólio.

CVE-2024-34355LOWTYPO3 vulnerable to an HTML Injection in the History ModuleEPSS 0.6%CVE-2023-47125MEDIUMBy-passing Cross-Site Scripting Protection in HTML SanitizerEPSS 0.6%CVE-2023-37905MEDIUMCross-site Scripting (XSS) in Source Mode of Editor in ckeditor-wordcount-pluginEPSS 0.6%CVE-2023-47127MEDIUMWeak Authentication in Session Handling in typo3/cms-coreEPSS 0.6%CVE-2024-25118MEDIUMInformation Disclosure of Hashed Passwords in TYPO3 Backend FormsEPSS 0.6%CVE-2022-23504MEDIUMTYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site ConfigurationEPSS 0.5%CVE-2024-25120MEDIUMImproper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3EPSS 0.5%CVE-2020-11064MEDIUMCross-Site Scripting in TYPO3 CMSEPSS 0.5%CVE-2020-11065MEDIUMCross-Site Scripting in TYPO3 CMSEPSS 0.5%CVE-2023-50461HIGHAn issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the exteEPSS 0.5%CVE-2022-23501MEDIUMTYPO3 vulnerable to Improper Authentication in Frontend LoginEPSS 0.5%CVE-2026-77128MEDIUMBroken Access Control in extension "Event management and registration" (sf_event_mgt)EPSS 0.5%CVE-2023-38500MEDIUMBy-passing Cross-Site Scripting Protection in HTML SanitizerEPSS 0.5%CVE-2024-34356MEDIUMTYPO3 vulnerable to Cross-Site Scripting in the Form Manager ModuleEPSS 0.5%CVE-2024-34357MEDIUMTYPO3 vulnerable to Cross-Site Scripting in ShowImageControllerEPSS 0.5%CVE-2024-25121HIGHImproper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3EPSS 0.5%CVE-2026-47345MEDIUMTYPO3 HTML Sanitizer allows Cross-Site ScriptingEPSS 0.5%CVE-2026-112069MEDIUMBroken Access Control in extension "FAL Protect" (fal_protect)EPSS 0.5%CVE-2024-34358MEDIUMTYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageControllerEPSS 0.5%CVE-2025-47941HIGHTYPO3 Has Broken Authentication in Backend MFAEPSS 0.5%