Where
-Infinity
0

Trending

Last week
Last month
Last year

Joachim Ruhs LocatorUnspecified vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 has unknow…

Risk 87
Severity
10
AV:N/AC:L/Au:N/C:C/I:C/A:C

Unspecified vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 has unknown impact and remote attack vectors, related to "Insecure Unserialize."

First published (updated )
CVE-2013-5303

Serge Gebhardt Dir ListingPath Traversal

Risk 87
Severity
10
Path Traversal
AV:N/AC:L/Au:N/C:C/I:C/A:C

Directory traversal vulnerability in the Directory Listing (dirlisting) extension 1.1.0 and earlier for TYPO3 allows remote attackers to have an unspecified impact via unknown vectors.

First published (updated )
CVE-2009-4952

Marco Hezel Hm TinymarketUnspecified vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 a…

Risk 87
Severity
10
AV:N/AC:L/Au:N/C:C/I:C/A:C

Unspecified vulnerability in the Tiny Market (hmtinymarket) extension 0.5.4 and earlier for TYPO3 allows attackers to execute arbitrary code via unknown vectors.

First published (updated )
CVE-2010-4889

JW Calendar JW CalendarUnspecified vulnerability in the JW Calendar (jw_calendar) extension 1.3.20 and earlier for TYPO3 al…

Risk 87
Severity
10
AV:N/AC:L/Au:N/C:C/I:C/A:C

Unspecified vulnerability in the JW Calendar (jwcalendar) extension 1.3.20 and earlier for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.

First published (updated )
CVE-2010-4953

CVE-2009-3819Unspecified vulnerability in the Random Images (maag_randomimage) extension 1.6.4 and earlier for TY…

Risk 87
Severity
10
AV:N/AC:L/Au:N/C:C/I:C/A:C

Unspecified vulnerability in the Random Images (maagrandomimage) extension 1.6.4 and earlier for TYPO3 allows remote attackers to execute arbitrary shell commands via unspecified vectors.

First published (updated )
CVE-2009-3819

TYPO3TYPO3-EXT-SA-2026-014: Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)

Risk 84
Severity
9.3
AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

The extension fails to safely process untrusted client input of an attacker-controlled cookie directly to PHP's unserialize(). A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

1 / 2
Source: MITRE
First published (updated )
CVE-2026-77138

Arco Van Geest Goof FotoboekUnspecified vulnerability in the Photo Book (goof_fotoboek) extension 1.7.14 and earlier for TYPO3 a…

Risk 44
Severity
7.8
AV:N/AC:L/Au:N/C:C/I:N/A:N

Unspecified vulnerability in the Photo Book (gooffotoboek) extension 1.7.14 and earlier for TYPO3 allows remote attackers to obtain sensitive information via unknown attack vectors.

First published (updated )
CVE-2010-0323

CVE-2008-6630Path Traversal

Risk 44
Severity
7.8
Path Traversal
AV:N/AC:L/Au:N/C:C/I:N/A:N

Directory traversal vulnerability in the wtgallery extension 2.5.0 and earlier for TYPO3 allows remote attackers to read arbitrary image files and determine directory structure via unspecified vectors.

First published (updated )
CVE-2008-6630

Webempoweredchurch Wec DiscussionSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the WEC Discussion Forum extension before 2.1.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-4720

Lina Wolf Seo Pack For Tt NewsSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the SEO Pack for ttnews extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-4719

Christophe Balisky Meta FeeditSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the metafeedit extension 0.1.10 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-4683

Raphael Zschorsch RzautocompleteSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the jQuery autocomplete for indexedsearch (rzautocomplete) extension before 0.0.9 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-4634

Michael Staatz Sofortueberweisung2commerceSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the sofortueberweisung2commerce extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-4681

3DS Push2rss 3dsSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the RSS feed from records extension 1.0.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-4721

Kurt Gusbeth MyquizpollSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the My quiz and poll (myquizpoll) extension before 2.0.6 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-4745

News Search Project News SearchSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the News Search (newssearch) extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-4870

Webempoweredchurch Wec DiscussionSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

Multiple SQL injection vulnerabilities in WEC Discussion Forum (wecdiscussion) extension 2.1.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands via unspecified vectors, as exploited in the wild in April 2011.

First published (updated )
CVE-2011-1722

Kennziffer Ke SearchSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the Faceted Search (kesearch) extension before 1.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-5302

Mauro Lorenzutti WfqbeSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the DB Integration (wfqbe) extension before 2.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-5310

Heiko Sudar SlideshareSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the Slideshare extension 0.1.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-5569

Die-netzmacher BrowserSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the Browser - TYPO3 without PHP (browser) extension before 4.5.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-5306

Joachim Ruhs LocatorSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the Store Locator (locator) extension before 3.1.5 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2013-5304

Stefan Koch T3mSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the T3M E-Mail Marketing Tool (t3m) extension 0.2.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2009-4959

Vincent Tietz VjchatSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the AJAX Chat (vjchat) extension before 0.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2009-4971

Typo3 SbannerSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the Solidbase Bannermanagement (SBbanner) extension 1.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2009-4969

Typo3-macher T3m AffiliateSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the t3maffiliate extension 0.5.0 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2009-4970

Joachim Ruhs LocatorSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the Store Locator extension before 1.2.8 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2009-4949

Jochen Rieger CarSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the Car (car) extension before 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2009-4967

Websedit Sk CalendarSQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the Versatile Calendar Extension [VCE] (skcalendar) extension before 0.3.4 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

First published (updated )
CVE-2009-4954

CVE-2009-4338SQL Injection

Risk 52
Severity
7.5
SQL Injection
AV:N/AC:L/Au:N/C:P/I:P/A:P

SQL injection vulnerability in the Flash SlideShow (slideshow) extension 0.2.2 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unknown vectors.

First published (updated )
CVE-2009-4338

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203