Posts by category TYPO3 Extensions en https://news.typo3.com/article/category/security/typo3-extensions/blog.category.xml Tue, 28 Jul 2026 13:06:51 +0200 https://news.typo3.com/security/advisory/typo3-ext-sa-2026-013https://news.typo3.com/security/advisory/typo3-ext-sa-2026-013#commentsTue, 19 May 2026 11:06:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-013It has been discovered that the extension "Content Element Selector" (ceselector) is vulnerable to Remote Code Execution. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-012https://news.typo3.com/security/advisory/typo3-ext-sa-2026-012#commentsTue, 19 May 2026 11:05:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-012It has been discovered that the extension "Address List" (tt_address) is vulnerable to SQL Injection. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-011https://news.typo3.com/security/advisory/typo3-ext-sa-2026-011#commentsTue, 19 May 2026 11:03:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-011It has been discovered that the extension "Faceted Search" (ke_search) is vulnerable to XML External Entity injection, Path Traversal and Information Disclosure. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-010https://news.typo3.com/security/advisory/typo3-ext-sa-2026-010#commentsTue, 19 May 2026 11:02:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-010It has been discovered that the extension "News system" (news) is vulnerable to SQL Injection. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-009https://news.typo3.com/security/advisory/typo3-ext-sa-2026-009#commentsTue, 19 May 2026 11:01:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-009It has been discovered that the extension "Frontend User Registration" (sf_register) is vulnerable to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-008https://news.typo3.com/security/advisory/typo3-ext-sa-2026-008#commentsTue, 19 May 2026 11:00:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-008It has been discovered that the extension "Site Crawler" (crawler) is vulnerable to Remote Code Execution. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-007https://news.typo3.com/security/advisory/typo3-ext-sa-2026-007#commentsTue, 17 Mar 2026 10:02:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-007It has been discovered that the extension "E-Mail MFA Provider" (mfa_email) is vulnerable to Authentication Bypass. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-006https://news.typo3.com/security/advisory/typo3-ext-sa-2026-006#commentsTue, 17 Mar 2026 10:01:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-006It has been discovered that the extension "Redirect Tab" (redirect_tab) is vulnerable to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-005https://news.typo3.com/security/advisory/typo3-ext-sa-2026-005#commentsTue, 17 Mar 2026 10:00:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-005It has been discovered that the extension "Mailqueue" (mailqueue) is vulnerable to insecure deserialization. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-004https://news.typo3.com/security/advisory/typo3-ext-sa-2026-004#commentsTue, 20 Jan 2026 08:33:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-004It has been discovered that the extension "Amazon AWS SDK" (aws) bundles a vulnerable version of “aws/aws-sdk-php“ which is susceptible to use of a Broken or Risky Cryptographic Algorithm. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-003https://news.typo3.com/security/advisory/typo3-ext-sa-2026-003#commentsTue, 20 Jan 2026 08:32:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-003It has been discovered that the extension "Amazon Web Services (AWS) Toolbox" (aws_tools) bundles a vulnerable version of “aws/aws-sdk-php“ which is susceptible to use of a Broken or Risky Cryptographic Algorithm. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-002https://news.typo3.com/security/advisory/typo3-ext-sa-2026-002#commentsTue, 20 Jan 2026 08:31:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-002It has been discovered that the extension "AWS SDK for PHP" (aws_sdk_php) bundles a vulnerable version of “aws/aws-sdk-php“ which is susceptible to use of a Broken or Risky Cryptographic Algorithm. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-001https://news.typo3.com/security/advisory/typo3-ext-sa-2026-001#commentsTue, 20 Jan 2026 08:30:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-001It has been discovered that the extension "Mailqueue" (mailqueue) is vulnerable to insecure deserialization. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-016https://news.typo3.com/security/advisory/typo3-ext-sa-2025-016#commentsWed, 17 Dec 2025 10:00:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-016It has been discovered that the extension "Single Sign-on with SAML" (md_saml) bundles a vulnerable version of “onelogin/php-saml“ which is susceptible to Authentication Bypass. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-015https://news.typo3.com/security/advisory/typo3-ext-sa-2025-015#commentsWed, 12 Nov 2025 11:31:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-015It has been discovered that the extension "Modules" (modules) is susceptible to Broken Authentication. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-014https://news.typo3.com/security/advisory/typo3-ext-sa-2025-014#commentsWed, 12 Nov 2025 11:30:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-014It has been discovered that the extension "Forms Export" (frp_form_answers) bundles a vulnerable version of "phpoffice/phpspreadsheet", which is susceptible to Server-Side Request Forgery. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-013https://news.typo3.com/security/advisory/typo3-ext-sa-2025-013#commentsTue, 16 Sep 2025 10:31:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-013It has been discovered that the extension "Base Excel" (base_excel) bundles a vulnerable version of “phpoffice/phpspreadsheet“ which is susceptible to Server-Side Request Forgery. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-012https://news.typo3.com/security/advisory/typo3-ext-sa-2025-012#commentsTue, 16 Sep 2025 10:30:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-012It has been discovered that the extension "Form to Database" (form_to_database) is susceptible to Cross-Site Scripting. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-011https://news.typo3.com/security/advisory/typo3-ext-sa-2025-011#commentsTue, 02 Sep 2025 10:30:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-011It has been discovered that the extension "TYPO3 Backup Plus" (ns_backup) is susceptible to Command Injection. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-010https://news.typo3.com/security/advisory/typo3-ext-sa-2025-010#commentsTue, 22 Jul 2025 11:04:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-010It has been discovered that the extension "femanager" (femanager) is susceptible to Insecure Direct Object Reference. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-009https://news.typo3.com/security/advisory/typo3-ext-sa-2025-009#commentsTue, 22 Jul 2025 11:02:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-009It has been discovered that the extension "powermail" (powermail) is susceptible to Insecure Direct Object Reference. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-008https://news.typo3.com/security/advisory/typo3-ext-sa-2025-008#commentsTue, 20 May 2025 12:04:00 +0200Marcus Krausehttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-008It has been discovered that the extension "Front End User Registration" (sr_feuser_register) is susceptible to Remote Code Execution and Insecure Direct Object Reference. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-007https://news.typo3.com/security/advisory/typo3-ext-sa-2025-007#commentsTue, 20 May 2025 12:03:00 +0200Marcus Krausehttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-007It has been discovered that the extension "Backup Plus" (ns_backup) is susceptible to Command Injection, Predictable Resource Location and Cross-Site Scripting. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-006https://news.typo3.com/security/advisory/typo3-ext-sa-2025-006#commentsTue, 20 May 2025 12:02:00 +0200Marcus Krausehttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-006It has been discovered that the extension "femanager" (femanager) is susceptible to Insecure Direct Object Reference. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-005https://news.typo3.com/security/advisory/typo3-ext-sa-2025-005#commentsTue, 20 May 2025 12:01:00 +0200Marcus Krausehttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-005It has been discovered that the extension "[clickstorm] SEO" (cs_seo) is susceptible to Cross-Site Scripting. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-004https://news.typo3.com/security/advisory/typo3-ext-sa-2025-004#commentsTue, 20 May 2025 12:00:00 +0200Marcus Krausehttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-004It has been discovered that the extension "Download manager" (reint_downloadmanager) is susceptible to Insecure Direct Object Reference. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-003https://news.typo3.com/security/advisory/typo3-ext-sa-2025-003#commentsTue, 18 Mar 2025 10:01:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-003It has been discovered that the extension "[clickstorm] SEO" (cs_seo) is susceptible to Cross-Site Scripting and Insecure Direct Object Reference. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-002https://news.typo3.com/security/advisory/typo3-ext-sa-2025-002#commentsTue, 18 Mar 2025 10:00:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-002It has been discovered that the extension “Additional TCA” (additional_tca) is susceptible to Cross-Site Scripting. https://news.typo3.com/security/advisory/typo3-ext-sa-2025-001https://news.typo3.com/security/advisory/typo3-ext-sa-2025-001#commentsTue, 28 Jan 2025 14:00:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2025-001It has been discovered that the extension "OpenID Connect Authentication" (oidc) is susceptible to Account Takeover. https://news.typo3.com/security/advisory/typo3-ext-sa-2024-007https://news.typo3.com/security/advisory/typo3-ext-sa-2024-007#commentsTue, 17 Sep 2024 10:20:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2024-007It has been discovered that the extension "powermail" (powermail) is susceptible to Insecure Direct Object Reference.