Posts by tag: Development en https://news.typo3.com/article/tag/development/blog.tag.xml Mon, 07 Sep 2026 11:19:50 +0200 https://news.typo3.com/security/advisory/typo3-ext-sa-2026-027https://news.typo3.com/security/advisory/typo3-ext-sa-2026-027#commentsTue, 25 Aug 2026 10:14:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-027It has been discovered that the extension "Forms Export" (frp_form_answers) is vulnerable to SQL Injection. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026https://news.typo3.com/security/advisory/typo3-ext-sa-2026-026#commentsTue, 25 Aug 2026 10:13:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-026It has been discovered that the extension "Events 2" (events2) is susceptible to two instances of Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025https://news.typo3.com/security/advisory/typo3-ext-sa-2026-025#commentsTue, 25 Aug 2026 10:12:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-025It has been discovered that the extension "Apache Solr for TYPO3 - Enterprise Search" (solr) is vulnerable to Broken Access Control, Insecure Deserialization and Information Disclosure. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024https://news.typo3.com/security/advisory/typo3-ext-sa-2026-024#commentsTue, 25 Aug 2026 10:11:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-024It has been discovered that the extension "femanager" (femanager) is vulnerable to Broken Access Control and Information Disclosure. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023https://news.typo3.com/security/advisory/typo3-ext-sa-2026-023#commentsTue, 25 Aug 2026 10:10:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-023It has been discovered that the extension "Event management and registration" (sf_event_mgt) is vulnerable to Broken Access Control and Server-Side Template Injection (SSTI). https://news.typo3.com/security/advisory/typo3-ext-sa-2026-022https://news.typo3.com/security/advisory/typo3-ext-sa-2026-022#commentsTue, 25 Aug 2026 10:09:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-022It has been discovered that the extension "powermail" (powermail) is vulnerable to Server-Side Template Injection (SSTI). https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021https://news.typo3.com/security/advisory/typo3-ext-sa-2026-021#commentsTue, 25 Aug 2026 10:08:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-021It has been discovered that the extension "Forum" (pforum) is susceptible to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-020https://news.typo3.com/security/advisory/typo3-ext-sa-2026-020#commentsTue, 25 Aug 2026 10:07:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-020It has been discovered that the extension "Industry Directory" (yellowpages2) is susceptible to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-019https://news.typo3.com/security/advisory/typo3-ext-sa-2026-019#commentsTue, 25 Aug 2026 10:06:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-019It has been discovered that the extension "Club Directory" (clubdirectory) is susceptible to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-018https://news.typo3.com/security/advisory/typo3-ext-sa-2026-018#commentsTue, 25 Aug 2026 10:05:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-018It has been discovered that the extension "Telephone Directory" (telephonedirectory) is susceptible to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-017https://news.typo3.com/security/advisory/typo3-ext-sa-2026-017#commentsTue, 25 Aug 2026 10:04:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-017It has been discovered that the extension "Mask" (mask) is vulnerable to Path Traversal. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-016https://news.typo3.com/security/advisory/typo3-ext-sa-2026-016#commentsTue, 25 Aug 2026 10:03:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-016It has been discovered that the extension "Modules" (modules) is vulnerable to Information Disclosure. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015https://news.typo3.com/security/advisory/typo3-ext-sa-2026-015#commentsTue, 25 Aug 2026 10:02:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-015It has been discovered that the extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy) is vulnerable to Insufficient Session Expiration and Cleartext Transmission of Sensitive Information. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-014https://news.typo3.com/security/advisory/typo3-ext-sa-2026-014#commentsTue, 25 Aug 2026 10:01:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-014It has been discovered that the extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail) is vulnerable to Remote Code Execution. https://news.typo3.com/article/typo3-joins-the-php-foundation-as-a-silver-sponsorhttps://news.typo3.com/article/typo3-joins-the-php-foundation-as-a-silver-sponsor#commentsTue, 30 Jun 2026 08:00:00 +0200Luana Valentinihttps://news.typo3.com/article/typo3-joins-the-php-foundation-as-a-silver-sponsorIn June 2026, TYPO3 joined the PHP Foundation as a Silver Sponsor, supporting the long-term development of the language its CMS and ecosystem have relied on for more than two decades. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-013https://news.typo3.com/security/advisory/typo3-ext-sa-2026-013#commentsTue, 19 May 2026 11:06:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-013It has been discovered that the extension "Content Element Selector" (ceselector) is vulnerable to Remote Code Execution. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-012https://news.typo3.com/security/advisory/typo3-ext-sa-2026-012#commentsTue, 19 May 2026 11:05:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-012It has been discovered that the extension "Address List" (tt_address) is vulnerable to SQL Injection. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-011https://news.typo3.com/security/advisory/typo3-ext-sa-2026-011#commentsTue, 19 May 2026 11:03:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-011It has been discovered that the extension "Faceted Search" (ke_search) is vulnerable to XML External Entity injection, Path Traversal and Information Disclosure. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-010https://news.typo3.com/security/advisory/typo3-ext-sa-2026-010#commentsTue, 19 May 2026 11:02:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-010It has been discovered that the extension "News system" (news) is vulnerable to SQL Injection. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-009https://news.typo3.com/security/advisory/typo3-ext-sa-2026-009#commentsTue, 19 May 2026 11:01:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-009It has been discovered that the extension "Frontend User Registration" (sf_register) is vulnerable to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-008https://news.typo3.com/security/advisory/typo3-ext-sa-2026-008#commentsTue, 19 May 2026 11:00:00 +0200Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-008It has been discovered that the extension "Site Crawler" (crawler) is vulnerable to Remote Code Execution. https://news.typo3.com/security/advisory/typo3-core-sa-2026-005https://news.typo3.com/security/advisory/typo3-core-sa-2026-005#commentsTue, 21 Apr 2026 11:05:00 +0200Oliver Haderhttps://news.typo3.com/security/advisory/typo3-core-sa-2026-005It has been discovered that TYPO3 CMS is susceptible to sensitive data exposure. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-007https://news.typo3.com/security/advisory/typo3-ext-sa-2026-007#commentsTue, 17 Mar 2026 10:02:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-007It has been discovered that the extension "E-Mail MFA Provider" (mfa_email) is vulnerable to Authentication Bypass. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-006https://news.typo3.com/security/advisory/typo3-ext-sa-2026-006#commentsTue, 17 Mar 2026 10:01:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-006It has been discovered that the extension "Redirect Tab" (redirect_tab) is vulnerable to Broken Access Control. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-005https://news.typo3.com/security/advisory/typo3-ext-sa-2026-005#commentsTue, 17 Mar 2026 10:00:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-005It has been discovered that the extension "Mailqueue" (mailqueue) is vulnerable to insecure deserialization. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-004https://news.typo3.com/security/advisory/typo3-ext-sa-2026-004#commentsTue, 20 Jan 2026 08:33:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-004It has been discovered that the extension "Amazon AWS SDK" (aws) bundles a vulnerable version of “aws/aws-sdk-php“ which is susceptible to use of a Broken or Risky Cryptographic Algorithm. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-003https://news.typo3.com/security/advisory/typo3-ext-sa-2026-003#commentsTue, 20 Jan 2026 08:32:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-003It has been discovered that the extension "Amazon Web Services (AWS) Toolbox" (aws_tools) bundles a vulnerable version of “aws/aws-sdk-php“ which is susceptible to use of a Broken or Risky Cryptographic Algorithm. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-002https://news.typo3.com/security/advisory/typo3-ext-sa-2026-002#commentsTue, 20 Jan 2026 08:31:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-002It has been discovered that the extension "AWS SDK for PHP" (aws_sdk_php) bundles a vulnerable version of “aws/aws-sdk-php“ which is susceptible to use of a Broken or Risky Cryptographic Algorithm. https://news.typo3.com/security/advisory/typo3-ext-sa-2026-001https://news.typo3.com/security/advisory/typo3-ext-sa-2026-001#commentsTue, 20 Jan 2026 08:30:00 +0100Torben Hansenhttps://news.typo3.com/security/advisory/typo3-ext-sa-2026-001It has been discovered that the extension "Mailqueue" (mailqueue) is vulnerable to insecure deserialization. https://news.typo3.com/security/advisory/typo3-core-sa-2026-004https://news.typo3.com/security/advisory/typo3-core-sa-2026-004#commentsTue, 13 Jan 2026 12:04:00 +0100Oliver Haderhttps://news.typo3.com/security/advisory/typo3-core-sa-2026-004It has been discovered that TYPO3 CMS is vulnerable to insecure deserialization.