CVE-2025-59022

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had permission to that particular table. This allowed attackers to purge and destroy critical site data, effectively rendering the website unavailable. This issue affects TYPO3 CMS versions 10.0.0-10.4.54, 11.0.0-11.5.48, 12.0.0-12.4.40, 13.0.0-13.4.22 and 14.0.0-14.0.1.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-590238.2Crafted delegations or IP fragments can poison cached delegations in Recursor.CVE-2025-590246.5Crafted delegations or IP fragments can poison cached delegations in Recursor.CVE-2025-590256.1Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, includi CVE-2025-590265.4Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be ex CVE-2025-590287.5When sending invalid base64 SASL data, login process is disconnected from the auth server, causing all active authentication sessions to fai CVE-2025-590295.3An attacker can trigger an assertion failure by requesting crafted DNS records, waiting for them to be inserted into the records cache, then CVE-2025-59038.8A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been classified as critical. Affected is the function setWiFiAclRules of the CVE-2025-590307.5An attacker can trigger the removal of cached records by sending a NOTIFY query over TCP.CVE-2025-590314.3Dovecot has provided a script to use for attachment to text conversion. This script unsafely handles zip-style attachments. Attacker can use CVE-2025-590327.5ManageSieve AUTHENTICATE command crashes when using literal as SASL initial response. This can be used to crash ManageSieve service repeated CVE-2025-590337.4The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. Entries that specify only t CVE-2025-590344.3Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a l