CVE-2025-30081

mediumpriority · track · 0DERUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

CVSS 6.3 · medium

Is it mine?

12 products

Check your exposure

Who says so?

4 sources

cnnvd · fstec_bdu · cert_bund · osv

РусскийShown in its original language — a full translation is planned for a future version.

Уязвимость расширения Clickstorm SEO (cs_seo) системы управления контентом TYPO3 существует из-за непринятия мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, проводить межсайтовые сценарные атаки

cvss

Technical severity, 0–10. One row per scoring source.

6.3

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.3mediumAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:F/RL:O/RC:Csecondary · OSV

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-79USCWE-79US

affected products (12)

Products and version ranges known to be affected.

TYPO3 Extension Additional TCA <1.15.17all versionscert_bundDE
TYPO3 Extension Additional TCA <1.16.9all versionscert_bundDE
TYPO3 Extension≤ Additional TCA <1.15.17cert_bundDE
TYPO3 Extension≤ Additional TCA <1.16.9cert_bundDE
Сообщество свободного программного обеспечения Clickstorm SEO6.0.0 → 6.7.0fstec_bduRU
Сообщество свободного программного обеспечения Clickstorm SEO7.0.0 → 7.4.0fstec_bduRU
Сообщество свободного программного обеспечения Clickstorm SEO8.0.0 → 8.3.0fstec_bduRU
Сообщество свободного программного обеспечения Clickstorm SEO9.0.0 → 9.2.0fstec_bduRU
Packagist clickstorm/cs-seo6.0.0 → 6.7.0osvUSpkg:composer/clickstorm/cs-seo
Packagist clickstorm/cs-seo7.0.0 → 7.4.0osvUSpkg:composer/clickstorm/cs-seo
Packagist clickstorm/cs-seo8.0.0 → 8.3.0osvUSpkg:composer/clickstorm/cs-seo
Packagist clickstorm/cs-seo9.0.0 → 9.2.0osvUSpkg:composer/clickstorm/cs-seo

advisories (2)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-0575TYPO3 Extension: Mehrere SchwachstellenDeutsch2025-03-17csaf · cert_bundDE
Ein entfernter, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in TYPO3 Extensions ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten und Sicherheitsmaßnahmen zu umgehen.
GHSA-vmgw-24w6-9v82Clickstorm SEO Allows Cross-Site Scripting (XSS)2025-03-19ghsa · osvUS
A cross-site scripting (XSS) vulnerability has been discovered in the Clickstorm SEO extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Updates 6.7.0, 7.4.0, 8.3.0 and 9.2.0 are available for download.

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd fstec_bdu cert_bund osv NVD CVE.org MITRE

published 2025-04-07modified 2026-08-21

references (1) cnnvd

External citations — patches, advisories, analysis.

https://vigilance.fr/vulnerability/TYPO3-Clickstorm-SEO-multiple-vulnerabilities-dated-18-03-2025-46618

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan