CVE-2025-12998
NoneCVSS
—
EPSS
0.4%
Published
Nov 12, 2025
CISA due date
—
The record
Improper Authentication vulnerability in TYPO3 Extension "Modules" codingms/modules.This issue affects Extension "Modules": before 4.3.11, from 5.0.0 before 5.7.4, from 6.0.0 before 6.4.2, from 7.0.0 before 7.5.5.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | codingms/modules | 0 | 4.3.11 |
| Packagist | codingms/modules | 5.0.0 | 5.7.4 |
| Packagist | codingms/modules | 6.0.0 | 6.4.2 |
| Packagist | codingms/modules | 7.0.0 | 7.5.5 |
| packagist | codingms/modules | 5.0.0 | 5.7.4 |
| packagist | codingms/modules | 6.0.0 | 6.4.2 |
| packagist | codingms/modules | 7.0.0 | 7.5.5 |
Related vulnerabilities
- GHSA-49qv-h8pm-73pf TYPO3 Modules Extension has Improper Authentication vulnerability Same vulnerability
- CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the… CWE-287
- CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass… CWE-287
- CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-287
- CVE-2026-107228 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-287
- CVE-2026-86781 The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40… CWE-287
- CVE-2026-14563 The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the… CWE-287
- CVE-2026-14559 The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's… CWE-287