CVE-2023-25013

7.5 highEPSS 0.5%

High (7.5) in in2code femanager. EPSS 0.5% chance of exploitation in the next 30 days.

An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauthenticated user to set the password of all frontend users.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
CWE: CWE-306
Published: 2023-02-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

in2code:femanager

References

https://typo3.org/help/security-advisories
https://typo3.org/security/advisory/typo3-ext-sa-2023-001
https://typo3.org/help/security-advisories
https://typo3.org/security/advisory/typo3-ext-sa-2023-001

Check your stack JSON