Composer typo3/cms-backend has 26 known advisories in the phpwarden feed. Feed 2026.10.29.1, updated 2026-10-28.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2009-3631 | TYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File Name | high | 0.0 | <=4.0.13 or >=4.1.0 and <4.1.13 or >=4.2.0 and <4.2.10 or >=4.3alpha1 and <4.3beta2 | 4.1.13, 4.2.10, 4.3beta2 |
| CVE-2010-3663 | TYPO3 Arbitrary Code Execution vulnerability on the backend | high | 8.8 | <4.1.14 or >=4.2 and <4.2.13 or >=4.3 and <4.3.4 or >=4.4 and <4.4.1 | 4.1.14, 4.2.13, 4.3.4, 4.4.1 |
| CVE-2009-3630 | TYPO3 Backend vulnerable to Frame Hijacking | medium | 0.0 | <=4.0.13 or >=4.1.0 and <4.1.13 or >=4.2.0 and <4.2.10 or >=4.3alpha1 and <4.3beta2 | 4.1.13, 4.2.10, 4.3beta2 |
| CVE-2009-3629 | TYPO3 Backend vulnerable to Cross-site Scripting | low | 0.0 | <=4.0.13 or >=4.1.0 and <4.1.13 or >=4.2.0 and <4.2.10 or >=4.3alpha1 and <4.3beta2 | 4.1.13, 4.2.10, 4.3beta2 |
| CVE-2010-3659 | TYPO3 Cross-site Scripting vulnerability in the extension manager and backend forms | medium | 5.4 | >=4.1.0 and <4.1.14 or >=4.2.0 and <4.2.13 or >=4.3.0 and <4.3.4 or >=4.4.0 and <4.4.1 | 4.1.14, 4.2.13, 4.3.4, 4.4.1 |
| CVE-2010-3664 | TYPO3 is vulnerable to Information Disclosure on the backend | medium | 6.5 | <4.1.14 or >=4.2.0 and <4.2.13 or >=4.3.0 and <4.3.4 or >=4.4.0 and <4.4.1 | 4.1.14, 4.2.13, 4.3.4, 4.4.1 |
| CVE-2010-3662 | TYPO3 SQL injection vulnerability on the backend | high | 8.8 | <4.1.14 or >=4.2.0 and <4.2.13 or >=4.3.0 and <4.3.4 or >=4.4.0 and <4.4.1 | 4.1.14, 4.2.13, 4.3.4, 4.4.1 |
| CVE-2009-3628 | TYPO3 Backend Discloses Encryption Key | medium | 0.0 | <=4.0.13 or >=4.1.0 and <4.1.13 or >=4.2.0 and <4.2.10 or >=4.3alpha1 and <4.3beta2 | 4.1.13, 4.2.10, 4.3beta2 |
| CVE-2008-5644 | TYPO3 Cross-site Scripting vulnerability in the file backend module | medium | 0.0 | >=4.2.2 and <4.2.3 | 4.2.3 |
| CVE-2010-3715 | TYPO3 cross-site scripting (XSS) vulnerability in the RemoveXSS function and the backend | medium | 0.0 | >=4.2.0 and <4.2.15 or >=4.3.0 and <4.3.7 or >=4.4.0 and <4.4.4 | 4.2.15, 4.3.7, 4.4.4 |
| CVE-2010-3661 | TYPO3 Open Redirection vulnerability on the backend | medium | 6.1 | <4.1.14 or >=4.2.0 and <4.2.13 or >=4.3.0 and <4.3.4 or >=4.4.0 and <4.4.1 | 4.1.14, 4.2.13, 4.3.4, 4.4.1 |
| CVE-2021-21340 | Cross-Site Scripting in Content Preview | medium | 5.4 | >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 | 10.4.14, 11.1.1 |
| CVE-2021-21370 | Cross-Site Scripting in Content Preview (CType menu) | medium | 5.4 | >=7.0.0 and <7.6.51 or >=8.0.0 and <8.7.40 or >=9.0.0 and <9.5.25 or >=10.0.0 and <10.4.14 or >=11.0.0 and <11.1.1 | 7.6.51, 8.7.40, 9.5.25, 10.4.14 |
| CVE-2010-3660 | TYPO3 is vulnerable to Cross-Site Scripting (XSS) on the backend | medium | 5.4 | <4.1.14 or >=4.2.0 and <4.2.13 or >=4.3.0 and <4.3.4 or >=4.4.0 and <4.4.1 | 4.1.14, 4.2.13, 4.3.4, 4.4.1 |
| CVE-2024-34537 | Denial of Service in TYPO3 Bookmark Toolbar | low | 2.7 | >=13.0.0 and <13.3.1 or >=12.0.0 and <12.4.21 or >=11.0.0 and <11.5.40 or >=10.0.0 and <10.4.46 | 13.3.1, 12.4.21, 11.5.40, 10.4.46 |
| CVE-2025-47941 | The TYPO3 CMS Backend has Broken Authentication in Backend MFA | high | 7.2 | >=12.0.0 and <12.4.31 or >=13.0.0 and <13.4.12 | 12.4.31, 13.4.12 |
| CVE-2026-77132 | TYPO3-CORE-SA-2026-022: Information Disclosure via Backend Localization Wizard | unknown | 0.0 | >=10.0.0 and <10.4.60 or >=11.0.0 and <11.5.54 or >=12.0.0 and <12.4.49 or >=13.0.0 and <13.4.35 or >=14.0.0 and <14.3.7 | 10.4.60, 11.5.54, 12.4.49, 13.4.35 |
| CVE-2025-59020 | TYPO3 CMS Allows Broken Access Control in Edit Document Controller | medium | 0.0 | >=14.0.0 and <14.0.2 or >=13.0.0 and <13.4.23 or >=12.0.0 and <12.4.41 or >=11.0.0 and <11.5.49 or >=10.0.0 and <10.4.55 | 14.0.2, 13.4.23, 12.4.41, 11.5.49 |
| CVE-2025-59017 | TYPO3 backend modules have Broken Access Control | medium | 0.0 | >=9.0.0 and <12.4.37 or >=10.0.0 and <12.4.37 or >=11.0.0 and <12.4.37 or >=12.0.0 and <12.4.37 or >=13.0.0 and <13.4.18 | 12.4.37, 13.4.18 |
| CVE-2024-47780 | Information Disclosure in TYPO3 Page Tree | low | 3.1 | >=13.0.0 and <13.3.1 or >=12.0.0 and <12.4.21 or >=11.0.0 and <11.5.40 or >=10.0.0 and <10.4.46 | 13.3.1, 12.4.21, 11.5.40, 10.4.46 |
| CVE-2025-59014 | TYPO3 Bookmark Toolbar vulnerable to denial of service | medium | 0.0 | >=11.0.0 and <12.4.37 or >=12.0.0 and <12.4.37 or >=13.0.0 and <13.4.18 | 12.4.37, 13.4.18 |
| CVE-2026-19418 | TYPO3 CMS - Broken Access Control in Backend and Install Tool | high | 0.0 | >=13.0.0 and <13.4.34 | 13.4.34 |
| CVE-2026-47351 | TYPO3 CMS: Broken Access Control in Media Module | medium | 0.0 | <10.4.57 or >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31 |
| CVE-2026-47352 | TYPO3 CMS has Broken Access Control in Backend API | medium | 0.0 | <10.4.57 or >=11.0.0 and <11.5.51 or >=12.0.0 and <12.4.46 or >=13.0.0 and <13.4.31 or >=14.0.0 and <14.3.3 | 10.4.57, 11.5.51, 12.4.46, 13.4.31 |
| CVE-2025-59019 | TYPO3 CSV download feature information disclosure | medium | 0.0 | >=12.0.0 and <12.4.37 or >=13.0.0 and <13.4.18 | 12.4.37, 13.4.18 |
| CVE-2026-6553 | TYPO3 CMS Stores Cleartext Password in User Settings Module | high | 7.5 | >=14.2.0 and <14.3.0 | 14.3.0 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# one-time install pip install phpwarden # then phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked