Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
730 results · page 13 of 15
Dec 2, 2009SQL injection vulnerability in the simple Glossar (simple_glossar) extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commanCVE-2009-4165 · Other software · Simple Glossar · reported by MITREHigh 7.5
SQL injection vulnerability in the simple Glossar (simple_glossar) extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Simple Glossar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2009Cross-site scripting (XSS) vulnerability in the simple Glossar (simple_glossar) extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrarCVE-2009-4164 · Other software · Simple Glossar · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the simple Glossar (simple_glossar) extension 1.0.3 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Simple Glossar
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2009SQL injection vulnerability in the TW Productfinder (tw_productfinder) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL coCVE-2009-4163 · Other software · TW Productfinder · reported by MITREHigh 7.5
SQL injection vulnerability in the TW Productfinder (tw_productfinder) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- TW Productfinder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2009Unspecified vulnerability in the DB Integration (wfqbe) extension 1.3.1 and earlier for TYPO3 allows local users to execute arbitrary commands via unspecified vCVE-2009-4162 · Other software · Mauro Lorenzutti · reported by MITREHigh 7.2
Unspecified vulnerability in the DB Integration (wfqbe) extension 1.3.1 and earlier for TYPO3 allows local users to execute arbitrary commands via unspecified vectors.
- Product
- Wfqbe
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2009Cross-site scripting (XSS) vulnerability in the [AN] Search it! (an_searchit) extension 2.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary CVE-2009-4161 · Other software · AN Searchit · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the [AN] Search it! (an_searchit) extension 2.4.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- AN Searchit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtypo3.orgsecurityfocus.com
Dec 2, 2009Unspecified vulnerability in the Simple download-system with counter and categories (kk_downloader) extension 1.2.1 and earlier for TYPO3 allows remote attackerCVE-2009-4160 · Other software · Kurt Kunig · reported by MITREMedium 5
Unspecified vulnerability in the Simple download-system with counter and categories (kk_downloader) extension 1.2.1 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.
- Product
- KK Downloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 2, 2009SQL injection vulnerability in the Calendar Base (cal) extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecifieCVE-2009-4158 · Other software · Mario Matzulla · reported by MITREHigh 7.5
SQL injection vulnerability in the Calendar Base (cal) extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- CAL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2009Cross-site scripting (XSS) vulnerability in the Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x beforCVE-2009-3636 · Other software · Typo3 · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in the Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2009The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain aCVE-2009-3635 · Other software · Typo3 · reported by Red HatMedium 6.8
The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to gain access by using only the password's md5 hash as a credential.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2009Cross-site scripting (XSS) vulnerability in the Frontend Login Box (aka felogin) subcomponent in TYPO3 4.2.0 through 4.2.6 allows remote attackers to inject arbCVE-2009-3634 · Other software · Typo3 · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in the Frontend Login Box (aka felogin) subcomponent in TYPO3 4.2.0 through 4.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2009Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and CVE-2009-3633 · Other software · Typo3 · reported by Red HatMedium 4.3
Cross-site scripting (XSS) vulnerability in the t3lib_div::quoteJSvalue API function in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to the sanitizing algorithm.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2009SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4CVE-2009-3632 · Other software · Typo3 · reported by Red HatMedium 6.5
SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to execute arbitrary SQL commands via unspecified parameters.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2009The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2, when the DAM extension or ftp upload CVE-2009-3631 · Other software · Typo3 · reported by Red HatHigh 8.5
The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2, when the DAM extension or ftp upload is enabled, allows remote authenticated users to execute arbitrary commands via shell metacharacters in a filename.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2009The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to pCVE-2009-3630 · Other software · Typo3 · reported by Red HatMedium 5.5
The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to place arbitrary web sites in TYPO3 backend framesets via crafted parameters, related to a "frame hijacking" issue.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2009Multiple cross-site scripting (XSS) vulnerabilities in the Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.xCVE-2009-3629 · Other software · Typo3 · reported by Red HatLow 3.5
Multiple cross-site scripting (XSS) vulnerabilities in the Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2009The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to dCVE-2009-3628 · Other software · Typo3 · reported by Red HatMedium 4
The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 allows remote authenticated users to determine an encryption key via crafted input to a tt_content form element.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2009Cross-site scripting (XSS) vulnerability in the Apache Solr Search (solr) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTCVE-2009-3821 · Websites & servers · Apache · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Apache Solr Search (solr) extension 1.0.0 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Solr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2009SQL injection vulnerability in the Flagbit Filebase (fb_filebase) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecCVE-2009-3820 · Other software · Flagbit · reported by MITREHigh 7.5
SQL injection vulnerability in the Flagbit Filebase (fb_filebase) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- FB Filebase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2009Unspecified vulnerability in the Random Images (maag_randomimage) extension 1.6.4 and earlier for TYPO3 allows remote attackers to execute arbitrary shell commaCVE-2009-3819 · Other software · URS Maag · reported by MITREHigh 10
Unspecified vulnerability in the Random Images (maag_randomimage) extension 1.6.4 and earlier for TYPO3 allows remote attackers to execute arbitrary shell commands via unspecified vectors.
- Product
- Maag Randomimage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2009Unspecified vulnerability in the session handling feature in freeCap CAPTCHA (sr_freecap) extension 1.2.0 and earlier for TYPO3 has unknown impact and attack veCVE-2009-3818 · Other software · Stanislas Rolland · reported by MITREHigh 10
Unspecified vulnerability in the session handling feature in freeCap CAPTCHA (sr_freecap) extension 1.2.0 and earlier for TYPO3 has unknown impact and attack vectors.
- Product
- SR Freecap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2009SQL injection vulnerability in the Virtual Civil Services (civserv) extension 4.3.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commaCVE-2009-2106 · Other software · Projektseminar Proservice WWU · reported by MITREHigh 7.5
SQL injection vulnerability in the Virtual Civil Services (civserv) extension 4.3.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Virtual Civil Services
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2009SQL injection vulnerability in the References database (t3references) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL comCVE-2009-2105 · Other software · Kasper Skrhj · reported by MITREHigh 7.5
SQL injection vulnerability in the References database (t3references) extension 0.1.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- References Database
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2009Cross-site scripting (XSS) vulnerability in the Modern Guestbook / Commenting System (ve_guestbook) extension 2.7.1 and earlier for TYPO3 allows remote attackerCVE-2009-2104 · Other software · UDO VON Eynern · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in the Modern Guestbook / Commenting System (ve_guestbook) extension 2.7.1 and earlier for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Modern Guest Book Commenting System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 17, 2009SQL injection vulnerability in the Frontend MP3 Player (fe_mp3player) 0.2.3 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL comCVE-2009-2103 · Other software · Steve Grundell · reported by MITREHigh 7.5
SQL injection vulnerability in the Frontend MP3 Player (fe_mp3player) 0.2.3 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Frontend Mp3 Player
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009Cross-site scripting (XSS) vulnerability in Resource Library (tjs_reslib) 0.1.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web CVE-2008-6699 · Other software · Typo3 · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in Resource Library (tjs_reslib) 0.1.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Product
- Typo3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009Cross-site scripting (XSS) vulnerability in TARGET-E WorldCup Bets (worldcup) 2.0.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary CVE-2008-6698 · Other software · Michael Fritz · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in TARGET-E WorldCup Bets (worldcup) 2.0.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Product
- Worldcup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009SQL injection vulnerability in TARGET-E WorldCup Bets (worldcup) 2.0.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commandsCVE-2008-6697 · Other software · Michael Fritz · reported by MITREHigh 7.5
SQL injection vulnerability in TARGET-E WorldCup Bets (worldcup) 2.0.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
- Product
- Worldcup
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009SQL injection vulnerability in Fussballtippspiel (toto) 0.1.1 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknCVE-2008-6696 · Other software · Manu Oehler · reported by MITREHigh 7.5
SQL injection vulnerability in Fussballtippspiel (toto) 0.1.1 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
- Product
- Toto
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009SQL injection vulnerability in TIMTAB social bookmark icons (timtab_sociable) 2.0.4 and earlier extension for TYPO3 allows remote attackers to execute arbitraryCVE-2008-6695 · Other software · Frank Naegler · reported by MITREHigh 7.5
SQL injection vulnerability in TIMTAB social bookmark icons (timtab_sociable) 2.0.4 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
- Product
- Timtab Sociable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009SQL injection vulnerability in Random Prayer (ste_prayer) 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.CVE-2008-6694 · Other software · Fr.simon Rundell · reported by MITREHigh 7.5
SQL injection vulnerability in Random Prayer (ste_prayer) 0.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
- Product
- STE Prayer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009SQL injection vulnerability in Download system (sb_downloader) extension 0.1.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands vCVE-2008-6693 · Other software · Sebastian Baumann · reported by MITREHigh 7.5
SQL injection vulnerability in Download system (sb_downloader) extension 0.1.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
- Product
- SB Downloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009SQL injection vulnerability in Diocese of Portsmouth Training Courses (pd_trainingcourses) extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrarCVE-2008-6692 · Other software · Fr.simon Rundell · reported by MITREHigh 7.5
SQL injection vulnerability in Diocese of Portsmouth Training Courses (pd_trainingcourses) extension 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
- Product
- PD Trainingcourses
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009SQL injection vulnerability in Diocese of Portsmouth Calendar Today (pd_calendar_today) extension 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SCVE-2008-6691 · Other software · Diocese Of Portsmouth · reported by MITREHigh 7.5
SQL injection vulnerability in Diocese of Portsmouth Calendar Today (pd_calendar_today) extension 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
- Product
- PD Calendar Today
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009Unspecified vulnerability in nepa-design.de Spam Protection (nd_antispam) extension 1.0.3 for TYPO3 allows remote attackers to modify configuration via unknown CVE-2008-6690 · Other software · Typo3 · reported by MITREHigh 7.5
Unspecified vulnerability in nepa-design.de Spam Protection (nd_antispam) extension 1.0.3 for TYPO3 allows remote attackers to modify configuration via unknown vectors.
- Product
- ND Antispam
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009SQL injection vulnerability in JobControl (dmmjobcontrol) 1.15.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via uCVE-2008-6689 · Other software · Kevin Renskers · reported by MITREHigh 7.5
SQL injection vulnerability in JobControl (dmmjobcontrol) 1.15.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
- Product
- Dmmjobcontrol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009Cross-site scripting (XSS) vulnerability in JobControl (dmmjobcontrol) 1.15.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web scCVE-2008-6688 · Other software · Kevin Renskers · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in JobControl (dmmjobcontrol) 1.15.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Product
- Dmmjobcontrol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009Cross-site scripting (XSS) vulnerability in DCD GoogleMap (dcdgooglemap) 1.1.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web sCVE-2008-6687 · Other software · David Cadu · reported by MITREMedium 4.3
Cross-site scripting (XSS) vulnerability in DCD GoogleMap (dcdgooglemap) 1.1.0 and earlier extension for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
- Product
- Dcdgooglemap
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009SQL injection vulnerability in CoolURI (cooluri) 1.0.11 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown veCVE-2008-6686 · Other software · JAN Bednarik · reported by MITREHigh 7.5
SQL injection vulnerability in CoolURI (cooluri) 1.0.11 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.
- Product
- Cooluri
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2009Unspecified vulnerability in Frontend Filemanager (air_filemanager) 0.6.1 and earlier extension for TYPO3 allows remote attackers to execute arbitrary commands CVE-2008-6685 · Other software · Thomas Waggershauser · reported by MITREHigh 7.5
Unspecified vulnerability in Frontend Filemanager (air_filemanager) 0.6.1 and earlier extension for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectors.
- Product
- AIR Filemanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2009Frontend User Registration (sr_feuser_register) extension 2.5.20 and earlier for TYPO3 does not properly verify access rights, which allows remote authenticatedCVE-2009-1264 · Other software · Stanislas Rolland · reported by MITREMedium 4
Frontend User Registration (sr_feuser_register) extension 2.5.20 and earlier for TYPO3 does not properly verify access rights, which allows remote authenticated users to obtain sensitive information such as passwords via unknown attack vectors.
- Product
- SR Feuser Register
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2009Directory traversal vulnerability in the wt_gallery extension 2.5.0 and earlier for TYPO3 allows remote attackers to read arbitrary image files and determine diCVE-2008-6630 · Other software · Typo3 · reported by MITREHigh 7.8
Directory traversal vulnerability in the wt_gallery extension 2.5.0 and earlier for TYPO3 allows remote attackers to read arbitrary image files and determine directory structure via unspecified vectors.
- Product
- WT Gallery
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2009SQL injection vulnerability in the pmk_rssnewsexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2008-6595 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the pmk_rssnewsexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- PMK Rssnewsexport Extension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2009SQL injection vulnerability in the cm_rdfexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2008-6594 · Other software · Network-publishing · reported by MITREHigh 7.5
SQL injection vulnerability in the cm_rdfexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- RDF Newsfeed Export
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2009SQL injection vulnerability in the My quiz and poll (myquizpoll) extension before 0.1.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via CVE-2008-6462 · Other software · Kurt Gusbeth · reported by MITREHigh 7.5
SQL injection vulnerability in the My quiz and poll (myquizpoll) extension before 0.1.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Myquizpoll
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2009SQL injection vulnerability in the Random Prayer 2 (ste_prayer2) extension before 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via CVE-2008-6461 · Other software · Fr.simon Rundell · reported by MITREHigh 7.5
SQL injection vulnerability in the Random Prayer 2 (ste_prayer2) extension before 0.0.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- STE Prayer2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2009SQL injection vulnerability in the Simple Random Objects (mw_random_objects) extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary CVE-2008-6460 · Other software · Mirko Werner · reported by MITREHigh 7.5
SQL injection vulnerability in the Simple Random Objects (mw_random_objects) extension 1.0.3 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- MW Random Objects
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2009SQL injection vulnerability in the auto BE User Registration (autobeuser) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQLCVE-2008-6459 · Other software · Typo3 · reported by MITREHigh 7.5
SQL injection vulnerability in the auto BE User Registration (autobeuser) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Autobeuser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2009SQL injection vulnerability in the FE address edit for tt_address & direct mail (dmaddredit) extension 0.4.0 and earlier for TYPO3 allows remote attackers to exCVE-2008-6458 · Other software · Dieter Mayer · reported by MITREHigh 7.5
SQL injection vulnerability in the FE address edit for tt_address & direct mail (dmaddredit) extension 0.4.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- FE Address Edit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2009SQL injection vulnerability in the Swigmore institute (cgswigmore) extension before 0.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands viCVE-2008-6457 · Other software · Walnutstreet · reported by MITREHigh 7.5
SQL injection vulnerability in the Swigmore institute (cgswigmore) extension before 0.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Cgswigmore
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 13, 2009SQL injection vulnerability in the HBook (h_book) extension 2.3.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecifieCVE-2008-6456 · Other software · Martin Helmich · reported by MITREHigh 7.5
SQL injection vulnerability in the HBook (h_book) extension 2.3.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
- Product
- Hbook
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.