TYPO3 CMS has an Open Redirect Vulnerability via Core Utilities
CVE-2026-47347
### Problem Applications that use `GeneralUtility::sanitizeLocalUrl` to allow only local URLs are vulnerable to open red
#composer
共收录 517 条相关情报。
← 返回所有主题TYPO3 CMS: Destructive Actions on File Mount Folders
CVE-2026-47343
### Problem Non-privileged backend users with file mount access were able to perform write operations (move, delete, ren
TYPO3 HTML Sanitizer allows Cross-site Scripting
CVE-2026-47345
Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting
TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework
CVE-2026-49741
### Problem Backend users with write access to the `form_definition` database table were able to directly create, update
TYPO3 CMS has Broken Access Control in its DataHandler
CVE-2026-47350
### Problem Backend users were able to move records to a different page without having edit permissions on the source pa
TYPO3 CMS has Broken Access Control in its Form Framework
CVE-2026-47346
### Problem Backend users with file write permissions were able to upload form definition files with mixed-case extensio
TYPO3 CMS has Broken Access Control in its Media Module
CVE-2026-49742
### Problem Backend users with file download permissions were able to download files from the fallback storage of the fi
TYPO3 CMS has Insecure Deserialization via Core API
CVE-2026-49740
### Problem TYPO3's cache frontend (`VariableFrontend`) and persistent key-value store (`Registry`) deserialized PHP pay
TYPO3 CMS has Broken Access Control in its File Abstraction Layer
CVE-2026-49738
### Problem The path allowance check in `GeneralUtility::isAllowedAbsPath()` performed a plain string prefix comparison
TYPO3 CMS has Broken Access Control in Backend API
CVE-2026-47352
### Problem Authenticated backend users were able to retrieve file metadata via several Backend API routes without prope
TYPO3 CMS: Broken Access Control in Media Module
CVE-2026-47351
### Problem Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read p
Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields
CVE-2026-48067
The `recordSelectOptionsQuery()` method may be used to scope the options available in the `Select` field for `AttachActi
CodeIgniter4 has a validation bypass when uploading file extensions via `ext_in` rule
CVE-2026-48062
### Impact The `ext_in` upload validation rule checked the MIME-derived guessed extension instead of the client-provided
guzzlehttp/guzzle-services' XML Request Serialization Vulnerable to XML Injection via CDATA Terminator
CVE-2026-53723
### Impact `guzzlehttp/guzzle-services` does not safely serialize scalar XML element values containing the CDATA termin
Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter
CVE-2026-48030
### Summary An OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execu
SymfonyRuntime CVE-2024-50340 Patch Bypass: Web Requests Can Still Set APP_ENV/APP_DEBUG via parse_str/SAPI Argv Mismatch
CVE-2026-47767
### Description CVE-2024-50340 (GHSA-x8vp-gf4q-mw5j) addressed an issue where, with `register_argc_argv=On`, a crafted
Poweradmin: CSV Injection in log export endpoints allows formula execution in spreadsheet applications
CVE-2026-47693
Description: ### Summary Poweradmin v4.4.0 is vulnerable to CSV Injection (Formula Injection) in its log export functi
PHPSpreadsheet has a patch bypass for CVE-2026-34084
CVE-2026-45034
## Summary CVE-2026-34084 was patched by the helper `File::prohibitWrappers`. The helper calls `parse_url($filename, PH
Twig: Sandbox: multiple `__toString()` policy bypasses via unguarded string coercion points
CVE-2026-47732
### Description `SandboxNodeVisitor` enforces `SecurityPolicy::checkMethodAllowed()` for implicit `__toString()` calls
Twig: XSS in profiler HtmlDumper via unescaped template and profile names
CVE-2026-47730
### Description `Twig\Profiler\Dumper\HtmlDumper` writes `Profile::getTemplate()` and `Profile::getName()` straight int