Typemill
Monthly
Credential brute-forcing against Typemill CMS (versions up to and including 2.25.0) is possible because its primary password-login endpoint (POST /tm/login, ControllerWebAuth::login()) implements no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled - the default state. Any unauthenticated attacker can submit unlimited password guesses against any account, including administrators, enabling account takeover of weakly-protected credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Arbitrary file read in Typemill before 2.24.0 allows authenticated Author-level users to traverse outside the content directory by injecting traversal sequences in the path query parameter when the folder argument is empty, defeating sanitization in Storage::getFolderPath(). Reported by VulnCheck with a vendor patch shipped in 2.24.0/2.24.2; no public exploit identified at time of analysis, and the CVSS 4.0 base score of 7.1 reflects high confidentiality impact with low-privilege network access.
Stored HTML attribute injection in Typemill versions prior to 2.23.0 allows authenticated content editors to embed arbitrary HTML attributes into generated og:title and og:description meta tags due to absent output encoding. Under applicable browser or DOM interaction conditions, this escalates to stored cross-site scripting (XSS) against any visitor loading the affected page. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; version 2.23.0 patches the issue and is confirmed by the official release notes.
Persistent XSS in Typemill CMS 2.x enables authenticated users holding theme-configuration access to store malicious JavaScript URI payloads via Markdown link syntax, which execute in victim browsers upon link click. The vulnerability exists in ParsedownExtension.php and TwigMarkdownExtension.php, where href values in Markdown links are rendered into HTML anchor tags without filtering the javascript: URI scheme, resulting in stored payloads that persist across all page loads. Successful exploitation delivers session cookie theft, authenticated request forgery, and credential harvesting against every visitor who clicks an injected link. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected XSS in Typemill's login error page allows unauthenticated attackers to inject malicious scripts by crafting requests with specially formatted usernames, since the username parameter lacks proper encoding when displayed after failed authentication attempts. Typemill versions 2.19.1 and below are affected, and public exploit code exists for this vulnerability. Version 2.19.2 contains the fix.
Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Credential brute-forcing against Typemill CMS (versions up to and including 2.25.0) is possible because its primary password-login endpoint (POST /tm/login, ControllerWebAuth::login()) implements no rate-limiting, failed-attempt counting, or account lockout when captcha is disabled - the default state. Any unauthenticated attacker can submit unlimited password guesses against any account, including administrators, enabling account takeover of weakly-protected credentials. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Arbitrary file read in Typemill before 2.24.0 allows authenticated Author-level users to traverse outside the content directory by injecting traversal sequences in the path query parameter when the folder argument is empty, defeating sanitization in Storage::getFolderPath(). Reported by VulnCheck with a vendor patch shipped in 2.24.0/2.24.2; no public exploit identified at time of analysis, and the CVSS 4.0 base score of 7.1 reflects high confidentiality impact with low-privilege network access.
Stored HTML attribute injection in Typemill versions prior to 2.23.0 allows authenticated content editors to embed arbitrary HTML attributes into generated og:title and og:description meta tags due to absent output encoding. Under applicable browser or DOM interaction conditions, this escalates to stored cross-site scripting (XSS) against any visitor loading the affected page. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; version 2.23.0 patches the issue and is confirmed by the official release notes.
Persistent XSS in Typemill CMS 2.x enables authenticated users holding theme-configuration access to store malicious JavaScript URI payloads via Markdown link syntax, which execute in victim browsers upon link click. The vulnerability exists in ParsedownExtension.php and TwigMarkdownExtension.php, where href values in Markdown links are rendered into HTML anchor tags without filtering the javascript: URI scheme, resulting in stored payloads that persist across all page loads. Successful exploitation delivers session cookie theft, authenticated request forgery, and credential harvesting against every visitor who clicks an injected link. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected XSS in Typemill's login error page allows unauthenticated attackers to inject malicious scripts by crafting requests with specially formatted usernames, since the username parameter lacks proper encoding when displayed after failed authentication attempts. Typemill versions 2.19.1 and below are affected, and public exploit code exists for this vulnerability. Version 2.19.2 contains the fix.
Typemill v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the upload function. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.