Servers and applications
CVE-2014-3942 The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object.
Severity Medium 6.0
Published 3 Jun 2014
Last changed 17 Jun 2026
Added to UpHeron 1 Nov 2026 Exploit chance 1.6% in the next 30 daysHigher than 76% of CVEs. EPSS by FIRST , 12 Nov 2026
Attack Over the network · Needs a login
Attacker can Read some data · Change some data · Slow it down
CVSS vector AV:N/AC:M/Au:S/C:P/I:P/A:P
Sources NVD Affected software Software Affected versions TYPO3Servers and applications · cpe:a:typo3:typo3 Version 6.1.8 Version 6.1.7 Version 6.1.6 Version 6.1.5 All 76 release lines Version 4.5.0 Version 4.5.1 Version 4.5.2 Version 4.5.3 Version 4.5.4 Version 4.5.5 Version 4.5.6 Version 4.5.7 Version 4.5.8 Version 4.5.9 Version 4.5.10 Version 4.5.11 Version 4.5.12 Version 4.5.13 Version 4.5.14 Version 4.5.15 Version 4.5.16 Version 4.5.17 Version 4.5.18 Version 4.5.19 Version 4.5.20 Version 4.5.21 Version 4.5.22 Version 4.5.23 Version 4.5.24 Version 4.5.25 Version 4.5.26 Version 4.5.27 Version 4.5.28 Version 4.5.29 Version 4.5.30 Version 4.5.31 Version 4.5.32 Version 4.5.33 Version 4.7.0 Version 4.7.1 Version 4.7.2 Version 4.7.3 Version 4.7.4 Version 4.7.5 Version 4.7.6 Version 4.7.7 Version 4.7.8 Version 4.7.9 Version 4.7.10 Version 4.7.11 Version 4.7.12 Version 4.7.13 Version 4.7.14 Version 4.7.15 Version 4.7.16 Version 4.7.17 Version 4.7.18 Version 6.0 Version 6.0.1 Version 6.0.2 Version 6.0.3 Version 6.0.4 Version 6.0.5 Version 6.0.6 Version 6.0.7 Version 6.0.8 Version 6.0.9 Version 6.0.10 Version 6.0.11 Version 6.0.12 Version 6.0.13 Version 6.1 Version 6.1.1 Version 6.1.2 Version 6.1.3 Version 6.1.4 Version 6.1.5 Version 6.1.6 Version 6.1.7 Version 6.1.8
References NVD https://nvd.nist.gov/vuln/detail/CVE-2014-3942 CVE.org https://www.cve.org/CVERecord?id=CVE-2014-3942