CVE-2021-32668

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When error messages are not properly encoded, the components _QueryGenerator_ and _QueryView_ are vulnerable to both reflected and persistent cross-site scripting. A valid backend user account having administrator privileges is needed to exploit this vulnerability. TYPO3 versions 9.5.29, 10.4.18, 11.3.1 contain a patch for this issue.

• CWE-79
• CWE-79

• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-6mh3-j5r5-2379Third Party Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2021-010Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-6mh3-j5r5-2379Third Party Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2021-010Vendor Advisory

Published

Jul 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-32662Backstage is an open platform for building developer portals…6.5
• CVE-2021-32663iTop is an open source web based IT Service Management tool.…7.5
• CVE-2021-32664Combodo iTop is an open source web based IT Service Manageme…4.8
• CVE-2021-32665wire-ios is the iOS version of Wire, an open-source secure m…6.5
• CVE-2021-32666wire-ios is the iOS version of Wire, an open-source secure m…6.5
• CVE-2021-32667TYPO3 is an open source PHP based web content management sys…5.4
• CVE-2021-32669TYPO3 is an open source PHP based web content management sys…5.4
• CVE-2021-3267File Upload vulnerability found in KiteCMS v.1.1 allows a re…7.2
• CVE-2021-32670Datasette is an open source multi-tool for exploring and pub…6.1
• CVE-2021-32671Flarum is a forum software for building communities. Flarum'…10
• CVE-2021-32672Redis is an open source, in-memory database that persists on…4.3
• CVE-2021-32673reg-keygen-git-hash-plugin is a reg-suit plugin to detect th…9.8