TYPO3 News

It has been discovered that the extension "TYPO3 Shop by coding.ms" (shop) is vulnerable to Broken Access Control.

It has been discovered that the extension “TYPO3 AI Integration Extension” (ns_t3ai) is vulnerable to SQL Injection and Sensitive Data Exposure.

It has been discovered that the extension "File manager" (ameos_filemanager) is vulnerable to SQL Injection.

It has been discovered that the extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) is vulnerable to Cross-Site Scripting and Broken Access Control.

It has been discovered that the extension "Kitodo.Presentation" (dlf) is vulnerable to Server-Side Request Forgery.

It has been discovered that the extension "Analytics" (analytics) is vulnerable to Insecure Direct Object Reference (IDOR) and Broken Access Control.

It has been discovered that the extension "Accessible Form Captcha" (bw_captcha) is vulnerable to Captcha Bypass.

It has been discovered that the extension "sgalinski Cookie Consent" (sg_cookie_optin) is vulnerable to SQL Injection and Missing Authorization.

It has been discovered that the extension "FAL Protect" (fal_protect) is vulnerable to Broken Access Control.

It has been discovered that TYPO3 CMS is susceptible to ignored upload storage configuration in the Form Framework.

It has been discovered that TYPO3 CMS is susceptible to unauthorized modification of system-wide configuration.

It has been discovered that TYPO3 CMS is susceptible to information disclosure.

It has been discovered that the extension "Forms Export" (frp_form_answers) is vulnerable to SQL Injection.

It has been discovered that the extension "Events 2" (events2) is susceptible to two instances of Broken Access Control.

It has been discovered that the extension "Apache Solr for TYPO3 - Enterprise Search" (solr) is vulnerable to Broken Access Control, Insecure Deserialization and Information Disclosure.

It has been discovered that the extension "femanager" (femanager) is vulnerable to Broken Access Control and Information Disclosure.

It has been discovered that the extension "Event management and registration" (sf_event_mgt) is vulnerable to Broken Access Control and Server-Side Template Injection (SSTI).

It has been discovered that the extension "powermail" (powermail) is vulnerable to Server-Side Template Injection (SSTI).