Vulnerabilidades em TYPO3

143 resultados
Análise Vexday

O ecossistema de vulnerabilidades do TYPO3 acumula 141 CVEs catalogadas, com 24 registros surgidos nos últimos 90 dias, o que indica um ritmo contínuo de descobertas que merece acompanhamento. Nenhuma das vulnerabilidades está listada no catálogo CISA KEV e não há PoCs públicas conhecidas, colocando a taxa de exploração ativa abaixo da média geral do catálogo — um indicador favorável, mas não suficiente para reduzir a vigilância. A falha mais comum é CWE-79 (Cross-Site Scripting), padrão que exige atenção especial em implementações que aceitam entrada de usuários sem sanitização adequada. A CVE mais perigosa atualmente rastreada é CVE-2026-46725, com score EPSS de 0,0231, sugerindo probabilidade de exploração ainda baixa, mas que deve ser monitorada dado o contexto das 2 vulnerabilidades de severidade crítica presentes no portfólio.

CVE-2020-26216HIGHCross-Site Scripting in TYPO3 FluidEPSS 1.0%CVE-2022-36105MEDIUMUser Enumeration via Response Timing in TYPO3EPSS 1.0%CVE-2011-4902—TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to delete arbitrary files on the webserver.EPSS 1.0%CVE-2020-15241MEDIUMCross-Site Scripting in TYPO3 Fluid EngineEPSS 1.0%CVE-2011-4627—TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows Information Disclosure on the backend.EPSS 1.0%CVE-2011-4900—TYPO3 before 4.5.4 allows Information Disclosure in the backend.EPSS 1.0%CVE-2021-21339MEDIUMCleartext storage of session identifierEPSS 0.9%CVE-2021-21358MEDIUMImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-formEPSS 0.9%CVE-2021-21370MEDIUMCross-Site Scripting in Content Preview (CType menu)EPSS 0.9%CVE-2021-21340MEDIUMCross-Site Scripting in Content PreviewEPSS 0.9%CVE-2011-4903—Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary weEPSS 0.8%CVE-2011-4626—Cross-site Scripting (XSS) in TYPO3 before 4.3.12, 4.4.x before 4.4.9, and 4.5.x before 4.5.4 allows remote attackers to inject arbitrary weEPSS 0.8%CVE-2023-24814HIGHPersisted Cross-Site Scripting in Frontend Rendering in typo3EPSS 0.8%CVE-2021-32767MEDIUMInformation Disclosure in User AuthenticationEPSS 0.8%CVE-2022-23503HIGHTYPO3 vulnerable to Arbitrary Code Execution via Form FrameworkEPSS 0.8%CVE-2022-36106MEDIUMMissing check for expiration time of password reset token in TYPO3EPSS 0.8%CVE-2022-36107MEDIUMStored Cross-Site Scripting via FileDumpControllerEPSS 0.7%CVE-2022-36108MEDIUMCross-Site Scripting in typo3/cms-coreEPSS 0.7%CVE-2021-32768MEDIUMCross-Site Scripting via Rich-Text ContentEPSS 0.7%CVE-2022-31048MEDIUMCross-Site Scripting in Form FrameworkEPSS 0.7%