TYPO3 News

It has been discovered that the extension "Frontend User Registration" (sf_register) is vulnerable to Broken Access Control.

It has been discovered that the extension "Mail" (mail) is vulnerable to Open Redirection, Information Disclosure, Broken Access Control, Server-Side Request Forgery and Cross-Site Scripting.

Two critical security vulnerabilities in PHP require prompt action: all TYPO3 users should update PHP on their installations right away. TYPO3 itself is not affected and does not need to be updated.

It has been discovered that the extension "TYPO3 Shop by coding.ms" (shop) is vulnerable to Broken Access Control.

It has been discovered that the extension “TYPO3 AI Integration Extension” (ns_t3ai) is vulnerable to SQL Injection and Sensitive Data Exposure.

It has been discovered that the extension "File manager" (ameos_filemanager) is vulnerable to SQL Injection.

It has been discovered that the extension "TYPO3 Fluid-Form by coding.ms" (fluid_form) is vulnerable to Cross-Site Scripting and Broken Access Control.

It has been discovered that the extension "Kitodo.Presentation" (dlf) is vulnerable to Server-Side Request Forgery.

It has been discovered that the extension "Analytics" (analytics) is vulnerable to Insecure Direct Object Reference (IDOR) and Broken Access Control.

It has been discovered that the extension "Accessible Form Captcha" (bw_captcha) is vulnerable to Captcha Bypass.

It has been discovered that the extension "sgalinski Cookie Consent" (sg_cookie_optin) is vulnerable to SQL Injection and Missing Authorization.

It has been discovered that the extension "FAL Protect" (fal_protect) is vulnerable to Broken Access Control.

It has been discovered that TYPO3 CMS is susceptible to ignored upload storage configuration in the Form Framework.

It has been discovered that TYPO3 CMS is susceptible to unauthorized modification of system-wide configuration.

It has been discovered that TYPO3 CMS is susceptible to information disclosure.

It has been discovered that the extension "Forms Export" (frp_form_answers) is vulnerable to SQL Injection.

It has been discovered that the extension "Events 2" (events2) is susceptible to two instances of Broken Access Control.

It has been discovered that the extension "Apache Solr for TYPO3 - Enterprise Search" (solr) is vulnerable to Broken Access Control, Insecure Deserialization and Information Disclosure.