https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:05:21.518171+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2022-avi-1097 certfr-2022-avi-1097 — De multiples vulnérabilités ont été découvertes dans Typo3 cms-core. Elles permettent à un attaquant de provoquer une e… 2026-10-02T22:05:21.575791+00:00 certfr-2022-avi-1097 https://cve.radiocsirt.org/vuln/euvd-2026-231906 EUVD-2026-231906 2026-10-02T22:05:21.575834+00:00 EUVD-2026-231906 https://cve.radiocsirt.org/vuln/fkie_cve-2022-23503 fkie_cve-2022-23503 2026-10-02T22:05:21.575849+00:00

TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injection. Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it is possible to inject code instructions to be processed and executed via TypoScript as PHP code. The existence of individual TypoScript instructions for a particular form item and a valid backend user account with access to the form module are needed to exploit this vulnerability. This issue is patched in versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1.

 https://cve.radiocsirt.org/vuln/ghsa-c5wx-6c2c-f7rm GHSA-c5wx-6c2c-f7rm — TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework 2026-10-02T22:05:21.575883+00:00

Affected: Packagist: typo3/cms-core, Packagist: typo3/cms

### Problem Due to the lack of separating user-submitted data from the internal configuration in the Form Designer backend module, it was possible to inject code instructions to be processed and executed via TypoScript as PHP code.

The existence of individual TypoScript instructions for a particular form item (known as [`formDefinitionOverrides`](https://docs.typo3.org/c/typo3/cms-form/main/en-us/I/Concepts/FrontendRendering/Index.html#form-element-properties)) and a valid backend user account with access to the form module are needed to exploit this vulnerability.

### Solution Update to TYPO3 versions 8.7.49 ELTS, 9.5.38 ELTS, 10.4.33, 11.5.20, 12.1.1 that fix the problem described above.

### References * [TYPO3-CORE-SA-2022-015](https://typo3.org/security/advisory/typo3-core-sa-2022-015)

 https://cve.radiocsirt.org/vuln/gsd-2022-23503 gsd-2022-23503 2026-10-02T22:05:21.575921+00:00 gsd-2022-23503 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2299 WID-SEC-W-2022-2299 — TYPO3 Core: Mehrere Schwachstellen 2026-10-02T22:05:21.575933+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in TYPO3 Core ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen und einen Denial of Service Zustand herzustellen.