Vulnerabilidades em TYPO3

198 resultados
Análise Vexday

O ecossistema de vulnerabilidades do TYPO3 acumula 141 CVEs catalogadas, com 24 registros surgidos nos últimos 90 dias, o que indica um ritmo contínuo de descobertas que merece acompanhamento. Nenhuma das vulnerabilidades está listada no catálogo CISA KEV e não há PoCs públicas conhecidas, colocando a taxa de exploração ativa abaixo da média geral do catálogo — um indicador favorável, mas não suficiente para reduzir a vigilância. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que exige atenção especial em implementações que aceitam entrada de usuários sem sanitização adequada. A CVE mais perigosa atualmente rastreada é CVE-2026-46725, com score EPSS de 0,0231, sugerindo probabilidade de exploração ainda baixa, mas que deve ser monitorada dado o contexto das 2 vulnerabilidades de severidade crítica presentes no portfólio.

CVE-2022-23499MEDIUMCross-Site Scripting Protection bypass in HTML SanitizerEPSS 0.5%CVE-2026-113442MEDIUMCross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)EPSS 0.5%CVE-2026-85400HIGHTYPO3 CMS - Missing Authorization in lowlevel commandsEPSS 0.5%CVE-2025-47940HIGHTYPO3 CMS Vulnerable to Privilege Escalation to System MaintainerEPSS 0.5%CVE-2026-112238HIGHSQL Injection in extension "File manager" (ameos_filemanager)EPSS 0.4%CVE-2026-113468MEDIUMBroken Access Control in extension "TYPO3 Shop by coding.ms" (shop)EPSS 0.4%CVE-2026-112071MEDIUMBroken Access Control in extension "TYPO3 Shop by coding.ms" (shop)EPSS 0.4%CVE-2026-8726HIGHSQL Injection in extension "News system" (news)EPSS 0.4%CVE-2026-77139MEDIUMPath Traversal in extension "Mask" (mask)EPSS 0.4%CVE-2026-112066HIGHMissing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)EPSS 0.4%CVE-2026-56096MEDIUMInformation Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)EPSS 0.4%CVE-2022-23502MEDIUMTYPO3 contains Insufficient Session Expiration after Password ResetEPSS 0.4%CVE-2026-77132MEDIUMTYPO3 CMS - Information Disclosure via Backend Localization WizardEPSS 0.4%CVE-2026-77146HIGHBroken Access Control in extension "femanager" (femanager)EPSS 0.4%CVE-2025-59022HIGHTYPO3 CMS Allows Broken Access Control in Recycler ModuleEPSS 0.4%CVE-2026-77144HIGHBroken Access Control in extension "Events 2" (events2)EPSS 0.4%CVE-2026-77143HIGHBroken Access Control in extension "Forum" (pforum)EPSS 0.4%CVE-2026-77141HIGHBroken Access Control in extension "Club Directory" (clubdirectory)EPSS 0.4%CVE-2026-77142HIGHBroken Access Control in extension "Industry Directory" (yellowpages2)EPSS 0.4%CVE-2026-77135HIGHInformation Disclosure in extension "femanager" (femanager)EPSS 0.4%