What’s Vulnerable › Vulnerabilities

CVE-2019-16698

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-10-16 · updated 2026-06-17
• Weakness: CWE-862

Description

The direct_mail (aka Direct Mail) extension through 5.2.2 for TYPO3 has a missing access check in the backend module, allowing a user (with restricted permissions to the fe_users table) to view and export data of frontend users who are subscribed to a newsletter.

Affected products

• Dkd Direct Mail: through 5.2.2

References

• https://extensions.typo3.org/extension/direct_mail
• https://typo3.org/security/advisory/typo3-ext-sa-2019-016/
• https://extensions.typo3.org/extension/direct_mail
• https://typo3.org/security/advisory/typo3-ext-sa-2019-016/

Get alerted when CVE-2019-16698 or the next vulnerability affects your stack