Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
730 results · page 10 of 15
Feb 14, 2012SQL injection vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commandCVE-2012-1072 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- TOI Category
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012SQL injection vulnerability in the Kitchen recipe (mv_cooking) extension before 0.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unCVE-2012-1071 · Other software · Mathieu Vidal · reported by MITREHigh 7.5
SQL injection vulnerability in the Kitchen recipe (mv_cooking) extension before 0.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild as of February 2012.
- Product
- MV Cooking
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Cross-site scripting (XSS) vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to inject aCVE-2012-1070 · Other software · Netcreators · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, possibly related to the "return url parameter."
- Product
- Irfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 14, 2012Cross-site scripting (XSS) vulnerability in lib/class.tx_jftcaforms_tceFunc.php in the Additional TCA Forms (jftcaforms) extension before 0.2.1 for TYPO3 allowsCVE-2011-5080 · Other software · Juergen Furrer · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in lib/class.tx_jftcaforms_tceFunc.php in the Additional TCA Forms (jftcaforms) extension before 0.2.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Jftcaforms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforge.typo3.orgosvdb.org
Feb 14, 2012Open redirect vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to redirect users to arbCVE-2011-5079 · Other software · Netcreators · reported by MITREMedium 5.8
Open redirect vulnerability in the Modern FAQ (irfaq) extension 1.1.2 and other versions before 1.1.4 for TYPO3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL, probably in the "return url parameter."
- Product
- Irfaq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2011Unspecified vulnerability in the Webkit PDFs (webkitpdf) extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectCVE-2010-4962 · Other software · Dev-team Typoheads · reported by MITREHigh 7.5
Unspecified vulnerability in the Webkit PDFs (webkitpdf) extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectors.
- Product
- Webkitpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2011SQL injection vulnerability in the Webkit PDFs (webkitpdf) extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecCVE-2010-4961 · Other software · Dev-team Typoheads · reported by MITREHigh 7.5
SQL injection vulnerability in the Webkit PDFs (webkitpdf) extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Webkitpdf
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2011Cross-site scripting (XSS) vulnerability in the Branchenbuch (aka Yellow Pages or mh_branchenbuch) extension before 0.9.1 for TYPO3 allows remote attackers to iCVE-2010-4960 · Other software · Martin Hesse · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Branchenbuch (aka Yellow Pages or mh_branchenbuch) extension before 0.9.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- MH Branchenbuch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2011SQL injection vulnerability in the Questionnaire (ke_questionnaire) extension before 2.2.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands vCVE-2010-4957 · Other software · Nadine Schwingler · reported by MITREHigh 7.5
SQL injection vulnerability in the Questionnaire (ke_questionnaire) extension before 2.2.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- KE Questionnaire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2011Cross-site scripting (XSS) vulnerability in the Questionnaire (ke_questionnaire) extension before 2.2.3 for TYPO3 allows remote attackers to inject arbitrary weCVE-2010-4956 · Other software · Nadine Schwingler · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Questionnaire (ke_questionnaire) extension before 2.2.3 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- KE Questionnaire
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2011Unspecified vulnerability in the JW Calendar (jw_calendar) extension 1.3.20 and earlier for TYPO3 allows remote attackers to execute arbitrary code via unknown CVE-2010-4953 · Other software · JW Calendar · reported by MITREHigh 10
Unspecified vulnerability in the JW Calendar (jw_calendar) extension 1.3.20 and earlier for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.
- Product
- JW Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgexchange.xforce.ibmcloud.com
Oct 9, 2011SQL injection vulnerability in the FE user statistic (festat) extension before 0.2.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unsCVE-2010-4952 · Other software · Joachim Ruhs · reported by MITREHigh 7.5
SQL injection vulnerability in the FE user statistic (festat) extension before 0.2.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Festat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2011Cross-site scripting (XSS) vulnerability in the xaJax Shoutbox (vx_xajax_shoutbox) extension before 1.0.1 for TYPO3 allows remote attackers to inject arbitrary CVE-2010-4951 · Other software · Thomas Mammitzsch · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the xaJax Shoutbox (vx_xajax_shoutbox) extension before 1.0.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- VX Xajax Shoutbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 9, 2011SQL injection vulnerability in the Event (event) extension before 0.3.7 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectCVE-2010-4950 · Other software · Joachim Ruhs · reported by MITREHigh 7.5
SQL injection vulnerability in the Event (event) extension before 0.3.7 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Event
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2011Cross-site scripting (XSS) vulnerability in the powermail extension before 1.5.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unCVE-2010-4892 · Other software · Alex Kellner · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the powermail extension before 1.5.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Powermail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2011SQL injection vulnerability in the Yet Another Calendar (ke_yac) extension before 1.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via CVE-2010-4891 · Other software · Andreas Kiefer · reported by MITREHigh 7.5
SQL injection vulnerability in the Yet Another Calendar (ke_yac) extension before 1.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- KE YAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2011Cross-site scripting (XSS) vulnerability in the Yet Another Calendar (ke_yac) extension before 1.1.2 for TYPO3 allows remote attackers to inject arbitrary web sCVE-2010-4890 · Other software · Andreas Kiefer · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Yet Another Calendar (ke_yac) extension before 1.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- KE YAC
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2011Unspecified vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 allows attackers to execute arbitrary code via unknown vectorCVE-2010-4889 · Other software · Marco Hezel · reported by MITREHigh 10
Unspecified vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 allows attackers to execute arbitrary code via unknown vectors.
- Product
- HM Tinymarket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2011SQL injection vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands vCVE-2010-4888 · Other software · Marco Hezel · reported by MITREHigh 7.5
SQL injection vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- HM Tinymarket
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2011SQL injection vulnerability in the Commenting system Backend Module (commentsbe) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrCVE-2010-4887 · Other software · Raphael Zschorsch · reported by MITREHigh 7.5
SQL injection vulnerability in the Commenting system Backend Module (commentsbe) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Commentsbe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2011Cross-site scripting (XSS) vulnerability in the "official twitter tweet button for your page" (tweetbutton) extension before 1.0.5 for TYPO3 allows remote attacCVE-2010-4886 · Other software · Peter Proell · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the "official twitter tweet button for your page" (tweetbutton) extension before 1.0.5 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Tweetbutton
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2011Cross-site scripting (XSS) vulnerability in the XING Button (xing) extension before 1.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTCVE-2010-4885 · Other software · Peter Proell · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the XING Button (xing) extension before 1.0.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2011Unspecified vulnerability in the Drag Drop Mass Upload (ameos_dragndropupload) extension 2.0.2 and earlier for TYPO3 allows remote attackers to upload arbitraryCVE-2011-3980 · Other software · Jerome Schneider · reported by MITREHigh 7.5
Unspecified vulnerability in the Drag Drop Mass Upload (ameos_dragndropupload) extension 2.0.2 and earlier for TYPO3 allows remote attackers to upload arbitrary files via unknown vectors.
- Product
- Ameos Dragndropupload
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgsecurityfocus.com
Apr 19, 2011Multiple SQL injection vulnerabilities in WEC Discussion Forum (wec_discussion) extension 2.1.0 and earlier for TYPO3 allow remote attackers to execute arbitrarCVE-2011-1722 · Other software · Webempoweredchurch · reported by MITREHigh 7.5
Multiple SQL injection vulnerabilities in WEC Discussion Forum (wec_discussion) extension 2.1.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in April 2011.
- Product
- WEC Discussion
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2010Unspecified vulnerability in the Extension Manager in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allows remote authenticated administCVE-2010-4068 · Other software · Typo3 · reported by MITREMedium 4.9
Unspecified vulnerability in the Extension Manager in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allows remote authenticated administrators to read and possibly modify arbitrary files via a crafted parameter, a different vulnerability than CVE-2010-3714.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2010The t3lib_div::validEmail function in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly restrict input to filter_var FILTECVE-2010-3717 · Other software · Typo3 · reported by Red HatMedium 5
The t3lib_div::validEmail function in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly restrict input to filter_var FILTER_VALIDATE_EMAIL operations in PHP, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a long e-mail address string, a related issue to CVE-2010-3710.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2010The be_user_creation task in TYPO3 4.2.x before 4.2.15 and 4.3.x before 4.3.7 allows remote authenticated users to gain privileges via a crafted POST request thCVE-2010-3716 · Other software · Typo3 · reported by Red HatMedium 6
The be_user_creation task in TYPO3 4.2.x before 4.2.15 and 4.3.x before 4.3.7 allows remote authenticated users to gain privileges via a crafted POST request that creates a user account with arbitrary group memberships.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2010Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote attackers to inject arCVE-2010-3715 · Other software · Typo3 · reported by Red HatMedium 4.3
Multiple cross-site scripting (XSS) vulnerabilities in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) the RemoveXSS function, and allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (2) the backend.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2010The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not pCVE-2010-3714 · Other software · Typo3 · reported by Red HatHigh 7.1
The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.nibblesec.orgtypo3.org
Sep 29, 2010Unspecified vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to bypass validation have an unspecified impact by "[inCVE-2010-3687 · Other software · Alex Kellner · reported by MITREMedium 5
Unspecified vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to bypass validation have an unspecified impact by "[injecting] arbitrary values into validated fields," as demonstrated using the (1) Email and (2) URL fields.
- Product
- Powermail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2010Cross-site scripting (XSS) vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML vCVE-2010-3605 · Other software · Alex Kellner · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Powermail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2010SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vecCVE-2010-3604 · Other software · Alex Kellner · reported by MITREHigh 7.5
SQL injection vulnerability in the powermail extension 1.5.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Powermail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2010SQL injection vulnerability in the AJAX Chat (vjchat) extension before 0.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecifiedCVE-2009-4971 · Other software · Vincent Tietz · reported by MITREHigh 7.5
SQL injection vulnerability in the AJAX Chat (vjchat) extension before 0.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Vjchat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgsecurityfocus.com
Jul 28, 2010SQL injection vulnerability in the t3m_affiliate extension 0.5.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2009-4970 · Other software · Typo3-macher · reported by MITREHigh 7.5
SQL injection vulnerability in the t3m_affiliate extension 0.5.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- T3m Affiliate
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgsecurityfocus.com
Jul 28, 2010SQL injection vulnerability in the Solidbase Bannermanagement (SBbanner) extension 1.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands viaCVE-2009-4969 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the Solidbase Bannermanagement (SBbanner) extension 1.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Sbanner
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgsecurityfocus.com
Jul 28, 2010SQL injection vulnerability in the Event Registration (event_registr) extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL comCVE-2009-4968 · Other software · Christian Ehmann · reported by MITREHigh 7.5
SQL injection vulnerability in the Event Registration (event_registr) extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Event Registr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgsecurityfocus.com
Jul 28, 2010SQL injection vulnerability in the Car (car) extension before 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2009-4967 · Other software · Jochen Rieger · reported by MITREHigh 7.5
SQL injection vulnerability in the Car (car) extension before 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- CAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgsecurityfocus.com
Jul 28, 2010SQL injection vulnerability in the AST ZipCodeSearch (ast_addresszipsearch) extension 0.5.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands CVE-2009-4966 · Other software · Elemente · reported by MITREHigh 7.5
SQL injection vulnerability in the AST ZipCodeSearch (ast_addresszipsearch) extension 0.5.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- AST Addresszipsearch
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgsecurityfocus.com
Jul 28, 2010SQL injection vulnerability in the AIRware Lexicon (air_lexicon) extension 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspeciCVE-2009-4965 · Other software · Thomas Waggershauser · reported by MITREHigh 7.5
SQL injection vulnerability in the AIRware Lexicon (air_lexicon) extension 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- AIR Lexicon
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgsecurityfocus.com
Jul 28, 2010Cross-site scripting (XSS) vulnerability in the Commerce extension before 0.9.9 for TYPO3 allows remote authenticated users to inject arbitrary web script or HTCVE-2009-4963 · Websites & servers · Typo3 · reported by MITRELow 3.5
Cross-site scripting (XSS) vulnerability in the Commerce extension before 0.9.9 for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Commerce Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgsecurityfocus.com
Jul 28, 2010SQL injection vulnerability in the T3M E-Mail Marketing Tool (t3m) extension 0.2.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commanCVE-2009-4959 · Other software · Stefan Koch · reported by MITREHigh 7.5
SQL injection vulnerability in the T3M E-Mail Marketing Tool (t3m) extension 0.2.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- T3m
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgsecurityfocus.com
Jul 22, 2010Cross-site scripting (XSS) vulnerability in the Visitor Tracking (ws_stats) extension before 0.1.2 for TYPO3 allows remote attackers to inject arbitrary web scrCVE-2009-4956 · Other software · Wapplersystems · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Visitor Tracking (ws_stats) extension before 0.1.2 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- WS Stats
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2010SQL injection vulnerability in the ultraCards (th_ultracards) extension before 0.5.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unsCVE-2009-4955 · Other software · Thomas Hempel · reported by MITREHigh 7.5
SQL injection vulnerability in the ultraCards (th_ultracards) extension before 0.5.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- TH Ultracards
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2010SQL injection vulnerability in the Versatile Calendar Extension [VCE] (sk_calendar) extension before 0.3.4 for TYPO3 allows remote attackers to execute arbitrarCVE-2009-4954 · Other software · Websedit · reported by MITREHigh 7.5
SQL injection vulnerability in the Versatile Calendar Extension [VCE] (sk_calendar) extension before 0.3.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- SK Calendar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2010Cross-site scripting (XSS) vulnerability in the Userdata Create/Edit (sg_userdata) extension before 0.91.0 for TYPO3 allows remote attackers to inject arbitraryCVE-2009-4953 · Other software · Stefan Geith · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Userdata Create/Edit (sg_userdata) extension before 0.91.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- SG Userdata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2010Directory traversal vulnerability in the Directory Listing (dir_listing) extension 1.1.0 and earlier for TYPO3 allows remote attackers to have an unspecified imCVE-2009-4952 · Other software · Serge Gebhardt · reported by MITREHigh 10
Directory traversal vulnerability in the Directory Listing (dir_listing) extension 1.1.0 and earlier for TYPO3 allows remote attackers to have an unspecified impact via unknown vectors.
- Product
- DIR Listing
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2010Unspecified vulnerability in the ClickStream Analyzer [output] (alternet_csa_out) extension 0.3.0 and earlier for TYPO3 allows remote attackers to obtain sensitCVE-2009-4951 · Other software · Hans Olthoff · reported by MITREMedium 5
Unspecified vulnerability in the ClickStream Analyzer [output] (alternet_csa_out) extension 0.3.0 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown vectors.
- Product
- Alternet CSA OUT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2010SQL injection vulnerability in the A21glossary Advanced Output (a21glossary_advanced_output) extension before 0.1.12 for TYPO3 allows remote attackers to executCVE-2009-4950 · Other software · TIM Lochmueller & Thomas Buss · reported by MITREHigh 7.5
SQL injection vulnerability in the A21glossary Advanced Output (a21glossary_advanced_output) extension before 0.1.12 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- A21glossary Advanced Output
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2010SQL injection vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectCVE-2009-4949 · Other software · Joachim Ruhs · reported by MITREHigh 7.5
SQL injection vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Locator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 22, 2010Cross-site scripting (XSS) vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to inject arbitrary web script or HTML viCVE-2009-4948 · Other software · Joachim Ruhs · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Locator
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.