UpHeron
All vulnerabilities

Servers and applications

CVE-2016-5091

Extbase in TYPO3 4.3.0 before 6.2.24, 7.x before 7.6.8, and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.

Severity
High 8.1
Published
23 Jan 2017
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
3.4% in the next 30 daysHigher than 88% of CVEs. EPSS by FIRST, 11 Nov 2026
Weakness
CWE-254
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read data · Change data · Take it down
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Sources
NVD

Affected software

SoftwareAffected versions
TYPO3Servers and applications · cpe:a:typo3:typo3
  • Version 8.1.1
  • Version 7.6.8
  • Version 7.6.7
  • Version 7.6.6
All 19 release lines
  • Every version up to 6.2.23
  • Version 7.0.0
  • Version 7.0.2
  • Version 7.1.0
  • Version 7.2.0
  • Version 7.3.0
  • Version 7.3.1
  • Version 7.4.0
  • Version 7.5.0
  • Version 7.6.0
  • Version 7.6.1
  • Version 7.6.2
  • Version 7.6.3
  • Version 7.6.4
  • Version 7.6.5
  • Version 7.6.6
  • Version 7.6.7
  • Version 7.6.8
  • Version 8.1.1

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2016-5091
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2016-5091