Vulnerability DatabaseWS-2019-0008
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
WS-2019-0008
Published:May 27, 2026
Updated:May 27, 2026
TYPO3 versions 7.1.0-7.6.31, 8.5.0-8.7.20 and 9.0.0-9.5.1 Failing to properly encode user input, notifications shown in modal windows in the TYPO3 backend are vulnerable to cross-site scripting.
Affected Packages
instituteweb/typo3-cms (PHP):
Affected version(s) >=dev-TYPO3_7 <6.2.19
Fix Suggestion:
Update to version 6.2.19
instituteweb/typo3-cms (PHP):
Affected version(s) >=7.6.4 <=8.7.10
Fix Suggestion:
Update to version no_fix
typo3/cms-backend (PHP):
Affected version(s) =9.2.x-dev <v9.2.0
Fix Suggestion:
Update to version v9.2.0
typo3/cms-backend (PHP):
Affected version(s) =9.3.x-dev <v9.3.0
Fix Suggestion:
Update to version v9.3.0
Related Resources (2)
https://github.com/TYPO3/TYPO3.CMS/commit/02cd5c97228cba477d16c68e28309ce25c433ce9
https://typo3.org/security/advisory/typo3-core-sa-2018-007/
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.1
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
PASSIVE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
NONE
Subsequent System Confidentiality
LOW
Subsequent System Integrity
LOW
Subsequent System Availability
NONE
CVSS v3
Base Score:
5.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE