Vulnerabilidades

Resumen — últimos 7 días

Vulnerabilidades nuevas2567▼ 333 respecto a la semana anterior

Críticas / altas1341▲ 75 respecto a la semana anterior

Nueva explotación activa (KEV)6▼ 5 respecto a la semana anterior

Sin puntuar (sin CVSS)93▼ 434 respecto a la semana anterior

8 resultados, ordenados por fecha de publicación (más recientes primero)

CVE	Estado	Severidad	EPSS	Explotación activa	Tecnologías afectadas	Publicada ▼	Modificada	Descripción
CVE-2023-50461	Aplazada	Alta (8.8)	0.33%	—	Typo3^AI Typo3 Direct Mail^AI	14/9/2026	22/9/2026	An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration Injection (TYPO3 10.4…
CVE-2020-12700	Modificada	Media (4.3)	0.78%	—	DKD Direct Mail	13/5/2020	17/6/2026	The direct_mail extension through 5.2.3 for TYPO3 allows Information Disclosure via a newsletter subscriber data Special Query.
CVE-2020-12699	Modificada	Media (6.1)	0.80%	—	DKD Direct Mail	13/5/2020	17/6/2026	The direct_mail extension through 5.2.3 for TYPO3 has an Open Redirect via jumpUrl.
CVE-2020-12698	Modificada	Media (4.3)	0.78%	—	DKD Direct Mail	13/5/2020	17/6/2026	The direct_mail extension through 5.2.3 for TYPO3 has Broken Access Control for newsletter subscriber tables.
CVE-2020-12697	Modificada	Media (5.3)	1.3%	—	DKD Direct Mail	13/5/2020	17/6/2026	The direct_mail extension through 5.2.3 for TYPO3 allows Denial of Service via log entries.
CVE-2019-16698	Modificada	Media (4.3)	0.69%	—	DKD Direct Mail	16/10/2019	17/6/2026	The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.
CVE-2013-7400	Modificada	Alta (7.5)	1.7%	—	DKD Direct Mail	29/12/2017	17/6/2026	The Direct Mail (direct_mail) extension before 3.1.2 for TYPO3 allows remote attackers to obtain sensitive information by leveraging improper checking of authentication codes.
CVE-2009-4159	Modificada	Baja (3.5)	0.84%	—	Ivan Kartolo Direct Mail	2/12/2009	16/6/2026	Cross-site scripting (XSS) vulnerability in the newsletter configuration feature in the backend module in the Direct Mail (direct_mail) extension 2.6.4 and earlier for TYPO3 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.