Typesettercms
Typesettercms Typesetter: vulnerabilidades y CVE
Typesettercms Typesetter tiene 14 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 0 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE14
Últimos 12 meses3
Críticas0
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-71166 | Media (4.8) | 0.23% | — | 14 ene 2026 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status move message handling. The path parameter is reflected… |
| CVE-2025-71165 | Media (4.8) | 0.23% | — | 14 ene 2026 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools Status functionality. The path parameter is reflected into… |
| CVE-2025-71164 | Media (4.8) | 0.23% | — | 14 ene 2026 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (submitted as images[] in a POST request) is reflected into an… |
| CVE-2022-25523 | Alta (8.8) | 0.55% | — | 25 mar 2022 | TypesetterCMS v5.1 was discovered to contain a Cross-Site Request Forgery (CSRF) which is exploited via a crafted POST request. |
| CVE-2020-19511 | Media (6.1) | 0.83% | — | 21 jun 2021 | Cross Site Scriptiong vulnerability in Typesetter 5.1 via the !1) className and !2) Description fields in index.php/Admin/Classes, |
| CVE-2020-35126 | Media (4.8) | 0.70% | — | 11 dic 2020 | Typesetter CMS 5.x through 5.1 allows admins to conduct Site Title persistent XSS attacks via an Admin/Configuration URI. NOTE: the significance of this report is disputed because "admins are considered trustworthy. |
| CVE-2020-25790 | Alta (7.2) | 16% | — | 19 sept 2020 | Typesetter CMS 5.x through 5.1 allows admins to upload and execute arbitrary PHP code via a .php file inside a ZIP archive. NOTE: the vendor disputes the significance of this report because "admins are considered… |
| CVE-2019-20077 | Media (4.3) | 0.41% | — | 5 ene 2020 | The Typesetter CMS 5.1 logout functionality is affected by a CSRF vulnerability. The logout function of the admin panel is not protected by any CSRF tokens. An attacker can logout the user using this vulnerability. |
| CVE-2018-16639 | Media (5.4) | 0.68% | — | 13 may 2019 | Typesetter 5.1 allows XSS via the index.php/Admin LABEL parameter during new page creation. |
| CVE-2018-16626 | Media (4.8) | 0.67% | — | 13 may 2019 | index.php/Admin/Classes in Typesetter 5.1 allows XSS via the description of a new class name. |
| CVE-2018-16625 | Media (4.8) | 0.67% | — | 13 may 2019 | index.php/Admin/Uploaded in Typesetter 5.1 allows XSS via an SVG file with JavaScript in a SCRIPT element. |
| CVE-2018-20837 | Media (4.8) | 0.73% | — | 9 may 2019 | include/admin/Menu/Ajax.php in Typesetter 5.1 has index.php/Admin/Menu/Ajax?cmd=AddHidden title XSS. |
| CVE-2018-6889 | Alta (8.8) | 6.7% | — | 12 feb 2018 | An issue was discovered in Typesetter 5.1. It suffers from a Host header injection vulnerability, Using this attack, a malicious user can poison the web cache or perform advanced password reset attacks or even trigger… |
| CVE-2018-6888 | Alta (8) | 1.9% | — | 12 feb 2018 | An issue was discovered in Typesetter 5.1. The User Permissions page (aka Admin/Users) suffers from critical flaw of Cross Site Request forgery: using a forged HTTP request, a malicious user can lead a user to… |