Skip to content
OpenAdvisories

Vendor

TYPO3

198 known vulnerabilities.

Products

typo3 58 TYPO3 CMS 54 HTML Sanitizer 6 Extension "Mail" 6 Extension "femanager" 5 Extension "Apache Solr for TYPO3 - Enterprise Search" 5 Extension "Faceted Search" 3 Extension "sgalinski Cookie Consent" 3 femanager 3 ns backup extension 3 Fluid 2 Extension "SYSSY - TYPO3 Monitoring & Security Checks" 2 Extension "TYPO3 AI Integration Extension" 2 Extension "TYPO3 Fluid-Form by coding.ms" 2 Extension "TYPO3 Shop by coding.ms" 2 Extension "Event management and registration" 2 Extension "Events 2" 2 Extension "Modules" 2 Extension "powermail" 2 Extension "Frontend User Registration" 2 Extension "Analytics" 2 sr feuser register extension 2 Extension "Mailqueue" 2 Extension "Redirect Tabs" 1 cms-rte-ckeditor 1 Extension "Forum" 1 femanager extension 1 Extension "Forms Export" 1 Extension "Address List" 1 Extension "Industry Directory" 1 Extension "News system" 1 oidc 1 Extension "E-Mail MFA Provider" 1 Extension "Accessible Form Captcha" 1 Extension "Telephone Directory" 1 Extension "Mask" 1 Extension "File manager" 1 Extension "Form to Database" (form_to_database) 1 Extension "Club Directory" 1 Extension "FAL Protect" 1
All Critical High Medium Low Exploited only Public exploit

5 results · Clear filters · Feed

  • Critical 9.5
    CVE-2026-77136

    Server-Side Template Injection in extension "powermail" (powermail)

    The extension passes the raw value of a form field configured as "This field contains the name of the sender" directly into a Fluid View as template source, without any sanitization, and renders it. An anonymous, unauthenticated user can submit Fluid template…

    TYPO3 Extension "powermail"
  • Critical 9.3
    CVE-2026-77138

    Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

    The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code E…

    TYPO3 Extension "HTML5 Video Player vs. Powermail"
  • Critical 9.2
    CVE-2026-46725 Scanner template

    Remote Code Execution in extension "Content Element Selector" (ceselector)

    The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Executio…

    TYPO3 Extension "Content Element Selector" mmc/ceselector Packagist
  • Critical 10.0
    CVE-2025-48200

    The Front End User Registration extension for TYPO3 (sr_feuser_register) Remote Code Execution

    The sr_feuser_register extension through 12.4.8 for TYPO3 allows Remote Code Execution.

    TYPO3 sr feuser register extension sjbr/sr-feuser-register Packagist
  • Critical 9.8
    CVE-2011-4628

    Typo3 Authentication Bypass

    TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to bypass authentication mechanisms in the backend through a crafted request.

    TYPO3 typo3 typo3/cms Web / CMS Packagist