TYPO3

A vulnerability in the TYPO3 Femanager extension (CVE-2024-42023) allows remote, unauthenticated attackers to bypass security mechanisms, potentially leading to unauthorized access within the CMS environment.

Multiple security flaws in various TYPO3 extensions enable remote authenticated or anonymous attackers to bypass security controls, perform information disclosure, and execute arbitrary code.

TYPO3 CMS versions 13.0.0 through 13.4.33 and 14.0.0 through 14.3.5 contain a broken access control vulnerability (CVE-2026-19418) that allows attackers to perform unauthorized actions by abusing ineffective referrer enforcement.

An unauthenticated broken access control vulnerability in the TYPO3 Club Directory extension allows remote attackers to overwrite or publish club records by supplying a known record UID to frontend actions.

A vulnerability in TYPO3 Core identified as CVE-2024-51978 allows a remote, authenticated attacker to bypass security restrictions within the framework.

Multiple vulnerabilities discovered in Typo3 allow an attacker to achieve remote arbitrary code execution, privilege escalation, data confidentiality compromise, data integrity compromise, security policy bypass, remote indirect code injection (XSS), and SQL injection (SQLi).

Multiple vulnerabilities in TYPO3 extensions allow an attacker to execute arbitrary program code, conduct SQL injection attacks, disclose information, and circumvent security measures.

TYPO3 CMS version 14.2.0 stores passwords in cleartext in the `uc` and `user_settings` fields of the `be_users` database table when users change their credentials in the backend user settings module.