Skip to content

Typo3 · weakness class

SQL Injection

54 CVEs

Every dot is a CVE in what this vendor ships; the named ones are the most at risk.

Every one of the 54 is a mark on the map. Named now: 1 to 26, most at risk first.

  1. SQL injection vulnerability in the Extbase Framework in TYPO3 4.5.x before 4.5.24, 4.6.x before 4.6.17, 4.7.x before 4.7.9, and 6.0.x before 6.0.3 allows remote attackers to execu…CVE-2013-1842Typo3 · 3.1% likely

    CWE-89

  2. SQL injection vulnerability in the Backend History module in TYPO3 4.5.x before 4.5.21, 4.6.x before 4.6.14, and 4.7.x before 4.7.6 allows remote authenticated backend users to ex…CVE-2012-6144Typo3 · 2.2% likely

    CWE-89

  3. SQL injection vulnerability in the traditional frontend editing feature in the Frontend Editing subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10,…CVE-2009-3632Typo3 · 1.6% likely

    CWE-89

  4. SQL injection vulnerability in the indexed_search system extension in TYPO3 3.x, 4.0 through 4.0.7, and 4.1 through 4.1.3 allows remote authenticated users to execute arbitrary SQ…CVE-2007-6381Typo3 · 1.3% likely

    CWE-89

  5. SQL injection vulnerability in the list module in TYPO3 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5 allows remote authenticated users with certain permissions…CVE-2010-5103Typo3 · 1.3% likely

    CWE-89

  6. TYPO3 before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4 and 4.4.x before 4.4.1 allows SQL Injection on the backend.CVE-2010-3662Typo3 · 1.2% likely

    CWE-89

  7. SQL injection vulnerability in the White Papers (mm_whtppr) extension 0.0.4 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2012-1074Typo3 · 1.1% likely

    CWE-89

  8. SQL injection vulnerability in the Category-System (toi_category) extension 0.6.0 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified v…CVE-2012-1072Typo3 · 1.1% likely

    CWE-89

  9. SQL injection vulnerability in the JobControl (dmmjobcontrol) 1.15.4 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vect…CVE-2008-4658Typo3 · 1.1% likely

    CWE-89

  10. SQL injection vulnerability in the auto BE User Registration (autobeuser) extension 0.0.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspe…CVE-2008-6459Typo3 · 1.1% likely

    CWE-89

  11. Multiple SQL injection vulnerabilities in the WEC Discussion Forum (wec_discussion) extension 1.7.0 and earlier for TYPO3 allow remote attackers to execute arbitrary SQL commands…CVE-2008-6145Typo3 · 1.1% likely

    CWE-89

  12. SQL injection vulnerability in the eluna Page Comments (eluna_pagecomments) extension 1.1.2 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via uns…CVE-2008-5796Typo3 · 1.1% likely

    CWE-89

  13. SQL injection vulnerability in the M1 Intern (m1_intern) 1.0.0 extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2008-4660Typo3 · 1.1% likely

    CWE-89

  14. SQL injection vulnerability in the Econda Plugin (econda) 0.0.2 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2008-4657Typo3 · 1.1% likely

    CWE-89

  15. SQL injection vulnerability in the Simple survey (simplesurvey) 1.7.0 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vec…CVE-2008-4655Typo3 · 1.1% likely

    CWE-89

  16. SQL injection vulnerability in the SQL Frontend (mh_omsqlio) extension 1.0.11 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vecto…CVE-2008-3053Typo3 · 1.1% likely

    CWE-89

  17. SQL injection vulnerability in the News Calendar (newscalendar) extension 1.0.7 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vec…CVE-2008-3044Typo3 · 1.1% likely

    CWE-89

  18. SQL injection vulnerability in the Library for Frontend Plugins (aka sg_zfelib) extension 1.1.512 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands v…CVE-2008-2489Typo3 · 1.1% likely

    CWE-89

  19. SQL injection vulnerability in the Solidbase Bannermanagement (SBbanner) extension 1.0.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vector…CVE-2009-4969Typo3 · 1.1% likely

    CWE-89

  20. SQL injection vulnerability in the pmk_rssnewsexport extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2008-6595Typo3 · 1.1% likely

    CWE-89

  21. SQL injection vulnerability in the Wir ber uns [sic] (fsmi_people) extension 0.0.24 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified…CVE-2008-5800Typo3 · 1.1% likely

    CWE-89

  22. SQL injection vulnerability in the CMS Poll system (cms_poll) extension before 0.1.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2008-5798Typo3 · 1.1% likely

    CWE-89

  23. SQL injection vulnerability in the advCalendar extension 0.3.1 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2008-5797Typo3 · 1.1% likely

    CWE-89

  24. SQL injection vulnerability in the Commerce extension 0.9.6 and earlier for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.CVE-2008-5609Typo3 · 1.1% likely

    CWE-89

  25. SQL injection vulnerability in the Mannschaftsliste (kiddog_playerlist) 1.0.3 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspeci…CVE-2008-4659Typo3 · 1.1% likely

    CWE-89

  26. SQL injection vulnerability in the Frontend Users View (feusersview) 0.1.6 and earlier extension for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecifie…CVE-2008-4656Typo3 · 1.1% likely

    CWE-89

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.