Technology · Packagist
typo3/cms (Packagist) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 187 vulnerabilities in typo3/cms (Packagist): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, TYPO3 Denial of Service in Online Media Asset Handling, was published on 7 June 2024.
- Last 7 days
- 0
- Last 90 days
- 0
- Critical, all time
- 0
- Exploited in the wild
- 0
About typo3/cms (Packagist)
TYPO3 CMS is a PHP-based content management system for building websites.
Latest typo3/cms (Packagist) vulnerabilities
- TYPO3 Denial of Service in Online Media Asset HandlinglowCVSS 3.1
- TYPO3 Information Disclosure in Install ToollowCVSS 3.1
- TYPO3 Security Misconfiguration in Install Tool CookielowCVSS 3.1
- TYPO3 Cross-Site Scripting in Frontend User LoginlowCVSS 3.1
- TYPO3 Cross-Site Scripting in Backend Modal ComponentlowCVSS 3.1
- TYPO3 Cross-Site Scripting in Online Media Asset RenderinglowCVSS 3.1
- TYPO3 Arbitrary Code Execution via File List ModulelowCVSS 3.1
- TYPO3 Denial of Service in Frontend Record RegistrationlowCVSS 3.1
- TYPO3 Information Disclosure of Installed ExtensionslowCVSS 3.1
- TYPO3 Cross-Site Scripting in Form Framework validation handlinglowCVSS 3.1
- TYPO3 Cross-Site Scripting in Form FrameworklowCVSS 3.1
- TYPO3 Security Misconfiguration for Backend User AccountslowCVSS 3.1
- TYPO3 Cross-Site Scripting in Link HandlinglowCVSS 3.1
- TYPO3 Broken Access Control in Localization HandlinglowCVSS 3.1
- TYPO3 Cross-Site Scripting in Filelist ModulelowCVSS 3.1
- TYPO3 Cross-Site Scripting in Fluid ViewHelperslowCVSS 3.1
- TYPO3 CMS Possible Insecure Deserialization in Extbase Request HandlinglowCVSS 3.1
- Typo3 Cross-Site Scripting in Language Pack Handlinginfo
- Typo3 Broken Access Control in Import Moduleinfo
- Typo3 Information Disclosure in Page Treeinfo
- Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend APIinfo
- Typo3 Security Misconfiguration in Frontend Session Handlinginfo
- Typo3 Security Misconfiguration in User Session Handlinginfo
- Typo3 Information Disclosure in Backend User Interfaceinfo
- Typo3 Information Disclosure in User Authenticationinfo
Most severe typo3/cms (Packagist) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2016-4056: TYPO3 CMS stored XSS in Backend bookmark toolbarmediumCVSS 6.1EPSS 1.1%
- CVE-2009-0815: TYPO3 leaks a hash secret in an error messagemediumCVSS 4EPSS 42.2%
- CVE-2010-5099: TYPO3 Path Traversal vulnerabilitymediumCVSS 4EPSS 3.1%
- CVE-2009-3635: TYPO3 Install Tool Subcomponent Allows Access Using Only a Password's MD5 Hash as a CredentialmediumCVSS 4EPSS 2.1%
- CVE-2010-5101: TYPO3 Directory Traversal vulnerabilitymediumCVSS 4EPSS 1.9%
- CVE-2014-3945: TYPO3 vulnerable to authentication bypass via leveraging knowledge of password hashmediumCVSS 4EPSS 1.6%
- CVE-2014-3942: TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP codemediumCVSS 4EPSS 1.6%
- CVE-2010-1153: TYPO3 PHP remote file inclusion vulnerabilitymediumCVSS 4EPSS 1.2%
- CVE-2013-4250: TYPO3 doesn't properly check file extensionsmediumCVSS 4EPSS 1.1%
- CVE-2013-4321: TYPO3 vulnerable to remote authenticated arbitrary code executionmediumCVSS 4EPSS 1.1%
Vulnerabilities per week
Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many typo3/cms (Packagist) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/packagist-typo3-cms)<a href="https://junglewise.ai/threats/technologies/packagist-typo3-cms"><img src="https://junglewise.ai/threats/technologies/packagist-typo3-cms/badge.svg" alt="typo3/cms (Packagist) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/packagist-typo3-cms.json, and this page as text at https://junglewise.ai/threats/technologies/packagist-typo3-cms.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "typo3/cms (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/packagist-typo3-cms, 9 November 2026.