Composer topthink/framework has 19 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2022-47945 | ThinkPHP Framework vulnerable to remote code execution | critical | 9.8 | <6.0.14 | 6.0.14 |
| CVE-2022-33107 | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | <=6.0.12 | – |
| CVE-2022-38352 | ThinkPHP deserialization vulnerability | critical | 9.8 | <=6.0.13 | – |
| CVE-2022-25481 | Exposure of Resource to Wrong Sphere in ThinkPHP Framework | high | 7.5 | <=5.0.24 | – |
| CVE-2024-44902 | ThinkPHP deserialization vulnerability | critical | 9.8 | >=6.1.3 and <=8.0.4 | – |
| CVE-2022-44289 | Thinkphp has a code logic error | high | 8.8 | <=5.0.24 or >=5.1 and <=5.1.41 | – |
| CVE-2021-36567 | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | <=6.0.8 | – |
| CVE-2018-16385 | ThinkPHP SQL Injection vulnerability | critical | 9.8 | <5.1.23 | 5.1.23 |
| CVE-2021-44892 | ThinkPHP Remote Code Execution (RCE) vulnerability | high | 8.8 | <=3.2.3 | – |
| CVE-2021-36564 | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | <6.0.9 | 6.0.9 |
| CVE-2021-23592 | Deserialization of Untrusted Data in topthink/framework | critical | 9.8 | <6.0.12 | 6.0.12 |
| CVE-2018-18546 | ThinkPHP SQLi Vulnerability | critical | 9.8 | <=3.2.4 | – |
| CVE-2018-17566 | ThinkPHP SQL injection vulnerability | critical | 9.8 | =5.1.24 | – |
| CVE-2021-44350 | ThinkPHP5 SQL Injection vulnerability | critical | 9.8 | >=5.0 and <=5.1.22 | – |
| CVE-2018-18529 | ThinkPHP SQLi Vulnerability | critical | 9.8 | <=3.2.4 | – |
| CVE-2018-18530 | ThinkPHP SQLi Vulnerability | critical | 9.8 | <=5.1.25 | – |
| CVE-2025-50706 | ThinkPHP Path Traversal Vulnerability | critical | 0.0 | <=5.1.41 | – |
| CVE-2018-10225 | thinkphp SQL Injection via the index.php s parameter | critical | 9.8 | =3.1.3 | – |
| CVE-2024-34467 | ThinkPHP Cross-Site Scripting Vulnerability | medium | 6.1 | >=8.0.0 and <8.0.4 or >=6.1.0 and <6.1.5 or <6.0.17 | 8.0.4, 6.1.5, 6.0.17 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked