In2code develops a specialized portfolio of TYPO3-ecosystem plugins and extensions, including user management and email marketing tools such as femanager, powermail, and living user experience, positioned within a narrowly scoped but prominent niche of the web-application landscape. Vulnerabilities affecting this vendor skew toward serious outcomes and cluster around authorization and authentication weaknesses—including authorization-bypass conditions tied to user-controlled keys, cross-site scripting flaws, and missing authentication on critical functions—that are characteristic of plugin-based architectures operating within larger content-management platforms. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by In2code over time
Signals from CVEs in this vendor scope (10 CVEs).
10 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2022-35628CRITICAL A SQL injection issue was discovered in the lux extension before 17.6.1, and 18.x through 24.x before 24.0.2, for TYPO3. | Jul 12, 2022 | 9.8 | 37 | NO | NO |
CVE-2024-45233CRITICAL An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemente | Aug 29, 2024 | 9.8 | 28 | NO | NO |
CVE-2023-25014HIGH An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauth | Feb 2, 2023 | 7.5 | 24 | NO | NO |
CVE-2023-25013HIGH An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. Missing access checks in the InvitationController allow an unauth | Feb 2, 2023 | 7.5 | 24 | NO | NO |
CVE-2014-6292MEDIUM The femanager extension before 1.0.9 for TYPO3 allows remote frontend users to modify or delete the records of other frontend users via unspecified vectors. | Oct 3, 2014 | 6.4 | 22 | NO | NO |
CVE-2024-47047HIGH An issue was discovered in the powermail extension through 12.4.0 for TYPO3. It fails to validate the mail parameter of the createAction, resulting in Insecure Direct Object Refere | Sep 17, 2024 | 7.5 | 20 | NO | NO |
CVE-2021-36787MEDIUM The femanager extension before 5.5.1 and 6.x before 6.3.1 for TYPO3 allows XSS via a crafted SVG document. | Aug 13, 2021 | 5.4 | 20 | NO | NO |
CVE-2024-45232MEDIUM An issue was discovered in powermail extension through 12.3.5 for TYPO3. It fails to validate the mail parameter of the confirmationAction, resulting in Insecure Direct Object Refe | Aug 29, 2024 | 5.3 | 17 | NO | NO |
CVE-2022-44543MEDIUM The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groups (if there is a usergroup field on the | Dec 12, 2023 | 5.3 | 17 | NO | NO |
CVE-2008-2182MEDIUM Cross-site scripting (XSS) vulnerability in the powermail extension before 1.1.10 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. | May 13, 2008 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (10 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by In2code.
Media articles that mention a CVE ID that affects a product developed by In2code — matched by CVE ID, not by vendor name.