CVE-2009-3634

Cross-site scripting (XSS) vulnerability in the Frontend Login Box (aka felogin) subcomponent in TYPO3 4.2.0 through 4.2.6 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters.

• CWE-79

• http://marc.info/?l=oss-security&m=125632856206736&w=2
• http://marc.info/?l=oss-security&m=125633199111438&w=2
• http://secunia.com/advisories/37122Vendor Advisory
• http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/Patch, Vendor Advisory
• http://www.securityfocus.com/bid/36801Patch
• http://www.vupen.com/english/advisories/2009/3009Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53926
• http://marc.info/?l=oss-security&m=125632856206736&w=2
• http://marc.info/?l=oss-security&m=125633199111438&w=2
• http://secunia.com/advisories/37122Vendor Advisory
• http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-016/Patch, Vendor Advisory
• http://www.securityfocus.com/bid/36801Patch
• http://www.vupen.com/english/advisories/2009/3009Patch, Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53926

Published

Nov 2, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3628The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x …
• CVE-2009-3629Multiple cross-site scripting (XSS) vulnerabilities in the B…
• CVE-2009-3630The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x …
• CVE-2009-3631The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x …
• CVE-2009-3632SQL injection vulnerability in the traditional frontend edit…
• CVE-2009-3633Cross-site scripting (XSS) vulnerability in the t3lib_div::q…
• CVE-2009-3635The Install Tool subcomponent in TYPO3 4.0.13 and earlier, 4…
• CVE-2009-3636Cross-site scripting (XSS) vulnerability in the Install Tool…
• CVE-2009-3637Stack-based buffer overflow in the M_AddToServerList functio…
• CVE-2009-3638Integer overflow in the kvm_dev_ioctl_get_supported_cpuid fu…
• CVE-2009-3639The mod_tls module in ProFTPD before 1.3.2b, and 1.3.3 befor…
• CVE-2009-3640The update_cr8_intercept function in arch/x86/kvm/x86.c in t…